CVE-2026-19092

Deferred Deferred - Pending Action

Remote Code Execution in Tutor LMS WordPress Plugin

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: WPScan

Description

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-19092

Affected Vendors & Products

Vendor	Product	Version / Range
tutor_lms	tutor_lms	to 4.0.6 (exc)
themeum	tutor_lms	to 4.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Tutor LMS WordPress plugin before version 4.0.6. It allows unauthenticated users to overwrite internal variables during template rendering, enabling them to call arbitrary zero-argument PHP functions and retrieve their output. This is due to improper handling of request data.

Detection Guidance

Check if your Tutor LMS plugin version is below 4.0.6. Use WordPress admin panel or run: wp plugin list | grep tutor-lms. Inspect server logs for unusual PHP function calls or template rendering errors.

Impact Analysis

An attacker could exploit this to destroy user sessions, delete WordPress core options, or drop database tables. This severely impacts confidentiality, integrity, and availability of the WordPress site. The vulnerability is critical with a CVSS score of 9.8.

Compliance Impact

This vulnerability could lead to unauthorized access or manipulation of sensitive data, such as user sessions or database tables, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. The ability to delete core options or drop tables could result in loss of data integrity or availability, further compromising compliance.

Mitigation Strategies

Update Tutor LMS to version 4.0.6 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review and restrict user permissions to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-19092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70