Paper/Archive/CVE-2026-19092

CVE-2026-19092

Unknown Tutor LMS — Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 85.5.855 × 2017.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

Affected

ProductAffectedFixed inSource

Tutor LMS2.1.3 – < 4.0.64.0.6CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WPScan (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56