CVE-2026-19092
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- Affected products
- Tutor Lms
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 1.5% (72th percentile)
- Weakness
- CWE-74
- NVD status
- Deferred
- Published
- 2026-08-27
CVE-2026-19092 at NVD
1 known exploit for CVE-2026-19092
Proof-of-concept code and exploit modules indexed by Sploitus