The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing… (CVE-2026-19092)

CVE-2026-19092 affects the Tutor LMS WordPress plugin prior to version 4.0.6. The vulnerability arises because the plugin does not properly prevent request data from overwriting internal variables while rendering templates. This allows unauthenticated attackers to invoke arbitrary zero-argument PHP functions and receive their output, which can lead to severe impacts including data disclosure, modification, and service disruption. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability without authentication or user interaction to execute arbitrary zero-argument PHP functions. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability, potentially allowing data leakage, unauthorized changes, or denial of service.

A fix is available in Tutor LMS version 4.0.6. Users should upgrade to version 4.0.6 or later to remediate this vulnerability. No other mitigation steps are indicated.