CVE-2026-19092

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

Affected

Tutor LMS

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.00% chance of exploitation in the next 30 days, 80th percentile

Nuclei

critical · CWE-74

Published

2026-08-27

Updated

2026-08-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19092.yaml

References

• CVE Record
• NVD entry