PT-2026-82654 · WordPress · Tutor Lms
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Tutor LMS versions prior to 4.0.6
Description
The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during template rendering, enabling the invocation of arbitrary zero-argument PHP functions and the retrieval of their output.
Recommendations
Update the plugin to version 4.0.6 or later.
Exploit
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tutor Lms