CVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
Published Aug 27, 2026
·Updated
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Affected Software
1 affected component
Tutor LMS WordPress plugin<4.0.6
Event History
Aug 27, 2026
CVE Published
via MITRE·05:05 PM
Data Sourced
via MITRE·05:05 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Which installations are exposed?
WordPress sites using Tutor LMS versions earlier than 4.0.6 are affected. The issue can be reached remotely without authentication or user interaction.
2
What capability does an attacker gain?
An attacker can cause arbitrary PHP functions that take zero arguments to be invoked during template rendering and receive their output. The reported impact includes compromise of confidentiality, integrity, and availability.
3
Is an account or special permission required to exploit this issue?
No. The vulnerability is unauthenticated and requires no privileges, according to the supplied attack vector.