Vulnerabilities and security researches fortutor tutor
Direction: ascendingJun 07, 2024
Tutor LMS – eLearning and online course solution # CVE-2021-25017
- CVE, Research URL
- Date
- Jan 24, 2022
- Research Description
- The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Affected versions
-
max 1.9.12.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24182
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
- Affected versions
-
max 1.8.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24873
- CVE, Research URL
- Date
- Nov 24, 2021
- Research Description
- The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
- Affected versions
-
max 1.9.11.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24740
- CVE, Research URL
- Date
- Oct 18, 2021
- Research Description
- The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Affected versions
-
max 1.9.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24183
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
- Affected versions
-
max 1.8.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24185
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
- Affected versions
-
max 1.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2020-8615
- CVE, Research URL
- Date
- Feb 05, 2020
- Research Description
- A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
- Affected versions
-
max 1.5.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24455
- CVE, Research URL
- Date
- Aug 02, 2021
- Research Description
- The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Affected versions
-
max 1.9.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24242
- CVE, Research URL
- Date
- Apr 23, 2021
- Research Description
- The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
- Affected versions
-
max 1.8.8.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24181
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
- Affected versions
-
max 1.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24186
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
- Affected versions
-
max 1.8.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2021-24184
- CVE, Research URL
- Date
- Apr 06, 2021
- Research Description
- Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
- Affected versions
-
max 1.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-25990
- CVE, Research URL
- Date
- Nov 03, 2023
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
- Affected versions
-
max 2.2.0.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-0236
- CVE, Research URL
- Date
- Feb 07, 2023
- Research Description
- The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Affected versions
-
max 2.0.10.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-25700
- CVE, Research URL
- Date
- Nov 03, 2023
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
- Affected versions
-
max 2.2.0.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-25800
- CVE, Research URL
- Date
- Nov 03, 2023
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.
- Affected versions
-
max 2.2.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2022-2563
- CVE, Research URL
- Date
- Oct 17, 2022
- Research Description
- The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
max 2.0.10.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-4279
- CVE, Research URL
- Date
- May 16, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.
- Affected versions
-
max 2.7.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-1502
- CVE, Research URL
- Date
- Mar 21, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
- Affected versions
-
max 2.6.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-3133
- CVE, Research URL
- Date
- Jul 04, 2023
- Research Description
- The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
- Affected versions
-
max 2.2.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-1751
- CVE, Research URL
- Date
- Mar 13, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 2.6.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-3994
- CVE, Research URL
- Date
- Apr 25, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 2.7.0.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-4318
- CVE, Research URL
- Date
- May 16, 2024
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 2.7.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-1133
- CVE, Research URL
- Date
- Feb 29, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
- Affected versions
-
max 2.6.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-3553
- CVE, Research URL
- Date
- May 02, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
- Affected versions
-
max 2.7.0.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-4805
- CVE, Research URL
- Date
- Oct 17, 2023
- Research Description
- The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
max 2.3.0.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-1128
- CVE, Research URL
- Date
- Feb 29, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting
- Affected versions
-
max 2.6.1.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-1503
- CVE, Research URL
- Date
- Mar 21, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
- Affected versions
-
max 2.6.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2023-49829
- CVE, Research URL
- Date
- Dec 15, 2023
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored XSS.This issue affects Tutor LMS – eLearning and online course solution: from n/a through 2.2.4.
- Affected versions
-
max 2.3.0.
- Status
-
vulnerable
Jun 08, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-5438
- CVE, Research URL
- Date
- Jun 07, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
- Affected versions
-
max 2.7.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-4902
- CVE, Research URL
- Date
- Jun 07, 2024
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37256 is likely a duplicate of this issue.
- Affected versions
-
max 2.7.2.
- Status
-
vulnerable
Jun 10, 2024
Tutor LMS – eLearning and online course solution # CVE-2023-25799
- CVE, Research URL
- Date
- Jun 11, 2024
- Research Description
- Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.
- Affected versions
-
max 2.1.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-4223
- CVE, Research URL
- Date
- -
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
- Affected versions
-
max 2.7.0.
- Status
-
vulnerable
Jul 01, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-37256
- CVE, Research URL
- Date
- Jul 09, 2024
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.
- Affected versions
-
max 2.7.2.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-37266
- CVE, Research URL
- Date
- Jul 09, 2024
- Research Description
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.
- Affected versions
-
max 2.7.2.
- Status
-
vulnerable
Jul 14, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-37947
- CVE, Research URL
- Date
- Jul 20, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2.
- Affected versions
-
max 2.7.3.
- Status
-
vulnerable
Aug 04, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-39645
- CVE, Research URL
- Date
- Aug 27, 2024
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
- Affected versions
-
max 2.7.3.
- Status
-
vulnerable
Aug 11, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-43142
- CVE, Research URL
- Date
- Nov 01, 2024
- Research Description
- Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.
- Affected versions
-
max 2.7.4.
- Status
-
vulnerable
Aug 13, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-43231
- CVE, Research URL
- Date
- Aug 13, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.
- Affected versions
-
max 2.7.4.
- Status
-
vulnerable
Aug 20, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-43282
- CVE, Research URL
- Date
- Aug 19, 2024
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
- Affected versions
-
max 2.7.3.
- Status
-
vulnerable
Sep 11, 2024
Tutor LMS – eLearning and online course solution # CVE-2023-2919
- CVE, Research URL
- Date
- Sep 10, 2024
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 2.7.5.
- Status
-
vulnerable
Nov 23, 2024
Tutor LMS – eLearning and online course solution # CVE-2024-10400
- CVE, Research URL
- Date
- Nov 21, 2024
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 2.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2024-10393
- CVE, Research URL
- Date
- Nov 21, 2024
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
- Affected versions
-
max 2.7.7.
- Status
-
vulnerable
Apr 11, 2025
Tutor LMS – eLearning and online course solution # CVE-2025-32230
- CVE, Research URL
- Date
- Apr 10, 2025
- Research Description
- Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 3.4.0.
- Affected versions
-
max 3.4.1.
- Status
-
vulnerable
Sep 10, 2025
Tutor LMS – eLearning and online course solution # CVE-2025-58993
- CVE, Research URL
- Date
- Sep 09, 2025
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through <= 3.7.4.
- Affected versions
-
max 3.8.0.
- Status
-
vulnerable
Nov 10, 2025
Tutor LMS – eLearning and online course solution # CVE-2025-11564
- CVE, Research URL
- Date
- Oct 25, 2025
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
- Affected versions
-
max 3.9.0.
- Status
-
vulnerable
Jan 27, 2026
Tutor LMS – eLearning and online course solution # CVE-2025-47555
- CVE, Research URL
- Date
- Jan 22, 2026
- Research Description
- Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
- Affected versions
-
max 3.9.5.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2025-13935
- CVE, Research URL
- Date
- Jan 09, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.
- Affected versions
-
max 3.9.4.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2025-13679
- CVE, Research URL
- Date
- Jan 08, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.
- Affected versions
-
max 3.9.4.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2025-13934
- CVE, Research URL
- Date
- Jan 09, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
- Affected versions
-
max 3.9.4.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2025-13628
- CVE, Research URL
- Date
- Jan 09, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.
- Affected versions
-
max 3.9.4.
- Status
-
vulnerable
Mar 30, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-23799
- CVE, Research URL
- Date
- Mar 05, 2026
- Research Description
- Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.5.
- Affected versions
-
max 3.9.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2025-13673
- CVE, Research URL
- Date
- Feb 28, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.
- Affected versions
-
max 3.9.7.
- Status
-
vulnerable
Apr 13, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-3371
- CVE, Research URL
- Date
- Apr 11, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
- Affected versions
-
max 3.9.8.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-3360
- CVE, Research URL
- Date
- Apr 10, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
- Affected versions
-
max 3.9.8.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-3358
- CVE, Research URL
- Date
- Apr 11, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.
- Affected versions
-
max 3.9.8.
- Status
-
vulnerable
Apr 15, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-1371
- CVE, Research URL
- Date
- Feb 03, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
- Affected versions
-
max 3.9.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-1375
- CVE, Research URL
- Date
- Feb 03, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
- Affected versions
-
max 3.9.6.
- Status
-
vulnerable
Apr 16, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-40740
- CVE, Research URL
- Date
- Apr 15, 2026
- Research Description
- Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.
- Affected versions
-
max 3.9.8.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-0548
- CVE, Research URL
- Date
- Jan 20, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
- Affected versions
-
max 3.9.5.
- Status
-
vulnerable
Apr 19, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-6080
- CVE, Research URL
- Date
- Apr 17, 2026
- Research Description
- The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
- Affected versions
-
max 3.9.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-5502
- CVE, Research URL
- Date
- Apr 17, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.
- Affected versions
-
max 3.9.9.
- Status
-
vulnerable
Apr 25, 2026
Tutor LMS – eLearning and online course solution # CVE-2025-6680
- CVE, Research URL
- Date
- Oct 25, 2025
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.
- Affected versions
-
max 3.9.0.
- Status
-
vulnerable
May 02, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-40743
- CVE, Research URL
- Date
- -
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 CVE-2026-40743
- Affected versions
-
max 3.9.8.
- Status
-
vulnerable
May 16, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-6965
- CVE, Research URL
- Date
- May 13, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
- Affected versions
-
max 3.9.10.
- Status
-
vulnerable
Jun 13, 2026
Tutor LMS – eLearning and online course solution # CVE-2025-32223
- CVE, Research URL
- Date
- Mar 19, 2026
- Research Description
- Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
- Affected versions
-
max 3.9.5.
- Status
-
vulnerable
Jun 16, 2026
Tutor LMS – eLearning and online course solution # 3c44a038b5a73b63f8608357cb63822af90e0c72
- CVE, Research URL
- Date
- Dec 27, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user profile parameters in versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 1.9.12.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 00ba67e69f89f52d182e176888a9373661b25d65
- CVE, Research URL
- Date
- Aug 09, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 Tutor LMS <= 1.9.5 - Cross-Site Scripting The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 1.9.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # e3183ca8f40a8b8255e76aa786af542f61fd4039
- CVE, Research URL
- Date
- Mar 15, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 WordPress Tutor LMS plugin <= 1.7.6 - Multiple Blind/Time-based SQL Injection (SQLi) vulnerabilities Multiple Blind/Time-based SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.7.6).
- Affected versions
-
max 1.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 06aaa55408575dc1ed4ba180e534f1d880c8c8e8
- CVE, Research URL
- Date
- Feb 04, 2020
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.5.3 WordPress Tutor LMS plugin <= 1.5.2 - Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability found by Jinson Varghese Behanan in WordPress Tutor LMS plugin (versions <= 1.5.2).
- Affected versions
-
max 1.5.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # a3314365442535a2e6a69e0e81808ad00a73db31
- CVE, Research URL
- Date
- Mar 15, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 WordPress Tutor LMS plugin <= 1.7.6 - Unprotected AJAX Action to Privilege Escalation vulnerability Unprotected AJAX Action to Privilege Escalation vulnerability discovered by WordFence in WordPress Tutor LMS plugin (versions <= 1.7.6).
- Affected versions
-
max 1.7.7.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 3a9dbb3d-40d6-441a-a9b4-df9ae8c9e56b
- CVE, Research URL
- Date
- -
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 Tutor LMS < 1.9.13 - Reflected Cross-Site Scripting The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Affected versions
-
max 1.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 7978b7dd-54ca-4a13-9bc3-3cf96ad93339
- CVE, Research URL
- Date
- -
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 Tutor LMS < 1.9.6 - Reflected Cross-Site Scripting The plugin does not escape a page parameter before outputting it back in an student dashboard page, leading to a Reflected Cross-Site Scripting issue
- Affected versions
-
max 1.9.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # f45f6ece7a149ef21f523428e30b318cec30d4be
- CVE, Research URL
- Date
- Aug 09, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 WordPress Tutor LMS plugin <= 1.9.5 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Tutor LMS plugin (versions <= 1.9.5).
- Affected versions
-
max 1.9.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # a3214685552b19c79d7ea15e6f31c27f9d3f652e
- CVE, Research URL
- Date
- Mar 15, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 WordPress Tutor LMS plugin <= 1.8.2 - Multiple Union SQL Injection (SQLi) vulnerabilities Multiple Union SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.8.2).
- Affected versions
-
max 1.8.3.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # a9bca7a6-c409-41d4-995e-48fd0f8264a3
- CVE, Research URL
- Date
- -
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 Tutor LMS < 1.9.12 - Subscriber+ Stored Cross-Site Scripting The plugin does not escape the 'Job Title" field of user's profile, which could allow any authenticated users to set a Cross-Site Scripting payload in it, which will be triggered when an admin edit the related profile
- Affected versions
-
max 1.9.12.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 47f1f0d59fea5a02f6bc1f7f08864e0af23ef21e
- CVE, Research URL
- Date
- Dec 27, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 WordPress Tutor LMS plugin <= 1.9.11 - Stored Cross-Site Scripting (XSS) vulnerability Stored Cross-Site Scripting (XSS) vulnerability discovered by creadpag in WordPress Tutor LMS plugin (versions <= 1.9.11).
- Affected versions
-
max 1.9.12.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # e9d4939eaa9f0e95fdfd31a9d36a40b647374556
- CVE, Research URL
- Date
- Aug 22, 2022
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 2.0.9 Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 2.0.0-2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 2.0.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # bc1f93ade3fce02864fa36fa0f89b6284353387a
- CVE, Research URL
- Date
- Jan 10, 2021
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting The Tutor LMS plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 1.9.12 due to missing input and output sanitization of some user generated URLs.
- Affected versions
-
max 1.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 9261dbc836d67ce1db8c5eb9e851d2baee579312
- CVE, Research URL
- Date
- Jan 10, 2023
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 WordPress Tutor LMS Plugin <= 1.9.12 is vulnerable to Cross Site Scripting (XSS) Update the WordPress Tutor LMS plugin to the latest available version (at least 1.9.13). WPScanTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.13.
- Affected versions
-
max 1.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # 53077bd4-4e30-43a9-97f0-349135242395
- CVE, Research URL
- Date
- -
- Research Description
- Tutor LMS – eLearning and online course solution [tutor] < 1.9.11 Tutor LMS < 2.0.9 - Reflected Cross-Site Scripting The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting The issue was initially fixed in 1.9.13 but re-introduced in 2.0.0
- Affected versions
-
max 1.9.11.
- Status
-
vulnerable
Jun 19, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-10736
- CVE, Research URL
- Date
- Jun 18, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 3.9.12.
- Status
-
vulnerable
Jul 02, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-13443
- CVE, Research URL
- Date
- Jul 01, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 3.9.14.
- Status
-
vulnerable
Jul 15, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-12273
- CVE, Research URL
- Date
- Jul 13, 2026
- Research Description
- The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
- Affected versions
-
max 3.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-12271
- CVE, Research URL
- Date
- Jul 13, 2026
- Research Description
- The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
- Affected versions
-
max 3.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-12275
- CVE, Research URL
- Date
- Jul 13, 2026
- Research Description
- The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
- Affected versions
-
max 3.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-12274
- CVE, Research URL
- Date
- Jul 13, 2026
- Research Description
- The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
- Affected versions
-
max 3.9.13.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-57694
- CVE, Research URL
- Date
- Jul 13, 2026
- Research Description
- Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.
- Affected versions
-
max 3.9.14.
- Status
-
vulnerable
Jul 17, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-15022
- CVE, Research URL
- Date
- Jul 16, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.
- Affected versions
-
max 4.0.1.
- Status
-
vulnerable
Jul 29, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-15444
- CVE, Research URL
- Date
- Jul 28, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.0.2.
- Status
-
vulnerable
Aug 01, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-14310
- CVE, Research URL
- Date
- Jul 30, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
- Affected versions
-
max 4.0.0.
- Status
-
vulnerable
Aug 08, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-14306
- CVE, Research URL
- Date
- Aug 07, 2026
- Research Description
- The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.
- Affected versions
-
max 3.9.14.
- Status
-
vulnerable
Aug 25, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-14187
- CVE, Research URL
- Date
- Aug 22, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
- Affected versions
-
max 4.0.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-19093
- CVE, Research URL
- Date
- Aug 22, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
- Affected versions
-
max 4.0.6.
- Status
-
vulnerable
Aug 28, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-19094
- CVE, Research URL
- Date
- Aug 26, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
- Affected versions
-
max 4.0.6.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-16759
- CVE, Research URL
- Date
- Aug 28, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.
- Affected versions
-
max 4.0.6.
- Status
-
vulnerable
Sep 13, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-78175
- CVE, Research URL
- Date
- Sep 12, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
- Affected versions
-
max 4.0.8.
- Status
-
vulnerable
Sep 17, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-85572
- CVE, Research URL
- Date
- Sep 16, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
- Affected versions
-
Min 4.0.0, max 4.0.8.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-85569
- CVE, Research URL
- Date
- Sep 16, 2026
- Research Description
- The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
- Affected versions
-
Min 2.7.1, max 4.0.8.
- Status
-
vulnerable
Sep 19, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-88944
- CVE, Research URL
- Date
- Sep 19, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.
- Affected versions
-
max 4.0.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-89333
- CVE, Research URL
- Date
- Sep 19, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
- Affected versions
-
max 4.0.9.
- Status
-
vulnerable
Tutor LMS – eLearning and online course solution # CVE-2026-89081
- CVE, Research URL
- Date
- Sep 19, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 4.0.9.
- Status
-
vulnerable
Sep 23, 2026
Tutor LMS – eLearning and online course solution # CVE-2026-18439
- CVE, Research URL
- Date
- Sep 22, 2026
- Research Description
- The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
- Affected versions
-
max 4.0.8.
- Status
-
vulnerable