CVE-2026-16759
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. Missing authorization combined with unsanitized array keys passed to extract() inside tutor_load_template() allow attacker-controlled POST data to overwrite local variables and invoke arbitrary zero-argument PHP functions.
Risk Assessment
An unauthenticated attacker can invoke arbitrary zero-argument PHP functions on the server and, via WordPress core edit_user(), create a persistent subscriber-level account, potentially leading to further privilege escalation.
Recommendation
Immediately upgrade the Tutor LMS plugin to a version newer than 4.0.5 that contains the fix for this vulnerability.
Other vulnerabilities in Tutor LMS
See all- CVE-2026-111407Medium
The Tutor LMS plugin up to version 4.1.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows a malicious script to be stored and executed in a user's browser.
- CVE-2026-42698Medium
A race condition vulnerability in Tutor LMS by Themeum allows leveraging race conditions. Affects versions from n/a through 4.1.1.
- CVE-2026-15444Medium
The Tutor LMS plugin for WordPress up to version 4.0.1 is vulnerable to generic SQL Injection via the 'coupon_code' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.
- CVE-2026-19092Critical
The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- CVE-2026-93681Medium
The Tutor LMS plugin for WordPress (versions up to and including 4.1.0) is vulnerable to Stored Cross-Site Scripting via the display_name parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
- CVE-2026-96537High
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
- CVE-2026-100193Medium
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to and including 4.1.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires the targeted lesson page to have an empty nav-items array, which occurs naturally when a lesson has no content, no attachments, and comments are disabled or the viewer is not logged in.
- CVE-2026-42702High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
- CVE-2026-18439Medium
The Tutor LMS plugin for WordPress in versions up to and including 4.0.7 is vulnerable to Insecure Direct Object Reference via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values belong to a quiz/topic/course the requester is authorized to manage. An authenticated attacker with Instructor-level access or higher can overwrite content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and delete arbitrary quiz question and answer rows.
- CVE-2026-89333Medium
The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'student_id' parameter. Missing validation on a user-controlled key allows authenticated attackers with subscriber-level access and above to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs.
Original NVD description (English source)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS