CVE-2026-19094

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6

Description The software fails to validate values used in database queries and does not restrict the template files that a request can load. This allows unauthenticated users to perform SQL injection, where injected text is interpreted as grammar rather than data. This issue enables the unauthorized reading of question and answer content from courses that are not publicly available. The vulnerability is triggered via the offset and item per page parameters.

Recommendations Update Tutor LMS to version 4.0.6 or later. Avoid using the offset and item per page parameters until the update is applied.