/Vulnerability Library

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

CVE-2026-19092
Verified

Description

Tutor LMS WordPress plugin < 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output.

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Affected Product

tutor_lms

Published Date

August 31, 2026

Template Author

aryu-ru

CVE-2026-19092.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-19092
CWE ID:
cwe-74

References

https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/https://nvd.nist.gov/vuln/detail/CVE-2026-19092

Remediation Steps

Update to version 4.0.6 or later.