CVE-2026-85570: Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure

Published Nov 5, 2026

Updated

The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any enrolled student who can access and take an affected quiz can obtain the correct answers before submitting an attempt. The issue is described as affecting Subscriber-level users and above.

Does disabling answer reveal prevent disclosure?

No. Correct answers are included in the page served to the student regardless of the setting intended to control whether answers are revealed.

Which versions are affected?

Tutor LMS versions 1.6.4 through 4.1.3 are affected. Versions before 4.2.0 do not prevent the answer data from being included in the quiz page.

CVE-2026-85570: Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure

Event History

Frequently Asked Questions

Who can exploit this issue?

Does disabling answer reveal prevent disclosure?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does disabling answer reveal prevent disclosure?

Which versions are affected?