HomeWordPress vulnerabilitiesTutor LMS
Tutor LMS vulnerabilities
Tutor LMS has 65 known vulnerabilities in this database. The most recent published record is dated 22 Sep 2026.
- Known vulnerabilities
- 65
- Active installs
- 100,000+
- Latest version
- 4.1.0
- Last updated
- 29 Sep 2026
- Most recent
- 22 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-18439 | Medium 4.3 | Up to 4.0.7 | Fixed in a later version (latest 4.1.0) | 22 Sep 2026 |
| Broken access control CVE-2026-88944 | Medium 4.3 | Up to 4.0.8 | Fixed in a later version (latest 4.1.0) | 19 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-89081 | Medium 6.1 | Up to 4.0.8 | Fixed in a later version (latest 4.1.0) | 19 Sep 2026 |
| Broken access control CVE-2026-89333 | Medium 6.5 | Up to 4.0.8 | Fixed in a later version (latest 4.1.0) | 19 Sep 2026 |
| Privilege escalation CVE-2026-85569 | High 7.2 | Before 4.0.8 | Fixed in 4.0.8 | 16 Sep 2026 |
| Sensitive data exposure CVE-2026-85572 | Medium 4.3 | Before 4.0.8 | Fixed in 4.0.8 | 16 Sep 2026 |
| Remote code execution CVE-2026-78175 | High 8.8 | Up to 4.0.7 | Fixed in a later version (latest 4.1.0) | 12 Sep 2026 |
| Remote code execution CVE-2026-16759 | Medium 6.5 | Up to 4.0.5 | Fixed in a later version (latest 4.1.0) | 28 Aug 2026 |
| Security weakness CVE-2026-19092 | Critical 9.8 | Before 4.0.6 | Fixed in 4.0.6 | 27 Aug 2026 |
| SQL injection CVE-2026-19094 | Medium 5.3 | Before 4.0.6 | Fixed in 4.0.6 | 26 Aug 2026 |
| Security weakness CVE-2026-19093 | Medium 6.8 | Before 4.0.6 | Fixed in 4.0.6 | 22 Aug 2026 |
| Broken access control CVE-2026-14187 | Low 2.7 | Before 4.0.6 | Fixed in 4.0.6 | 22 Aug 2026 |
| Broken access control CVE-2026-14306 | Medium 4.3 | Before 3.9.14 | Fixed in 3.9.14 | 6 Aug 2026 |
| Broken access control CVE-2026-14310 | Medium 5.4 | Before 4.0.0 | Fixed in 4.0.0 | 30 Jul 2026 |
| SQL injection CVE-2026-15444 | Medium 4.9 | Up to 4.0.1 | Fixed in a later version (latest 4.1.0) | 28 Jul 2026 |
| SQL injection CVE-2026-15022 | Medium 6.5 | Up to 4.0.0 | Fixed in a later version (latest 4.1.0) | 16 Jul 2026 |
| Security weakness CVE-2026-12271 | Medium 5.4 | Before 3.9.13 | Fixed in 3.9.13 | 13 Jul 2026 |
| Security weakness CVE-2026-12273 | Medium 4.3 | Before 3.9.13 | Fixed in 3.9.13 | 13 Jul 2026 |
| Security weakness CVE-2026-12274 | Medium 6.5 | Before 3.9.13 | Fixed in 3.9.13 | 13 Jul 2026 |
| Security weakness CVE-2026-12275 | High 7.1 | Before 3.9.13 | Fixed in 3.9.13 | 13 Jul 2026 |
| Cross-site scripting (XSS) CVE-2026-13443 | Medium 6.4 | Up to 3.9.13 | Fixed in a later version (latest 4.1.0) | 1 Jul 2026 |
| SQL injection CVE-2026-10736 | Medium 4.9 | Up to 3.9.11 | Fixed in a later version (latest 4.1.0) | 18 Jun 2026 |
| Broken access control CVE-2026-6965 | Medium 5.3 | Up to 3.9.9 | Fixed in a later version (latest 4.1.0) | 13 May 2026 |
| Cross-site request forgery (CSRF) CVE-2026-5502 | Medium 5.3 | Up to 3.9.8 | Fixed in a later version (latest 4.1.0) | 17 Apr 2026 |
| SQL injection CVE-2026-6080 | Medium 6.5 | Up to 3.9.8 | Fixed in a later version (latest 4.1.0) | 17 Apr 2026 |
| Broken access control CVE-2026-3358 | Medium 5.4 | Up to 3.9.7 | Fixed in a later version (latest 4.1.0) | 11 Apr 2026 |
| Broken access control CVE-2026-3371 | Medium 4.3 | Up to 3.9.7 | Fixed in a later version (latest 4.1.0) | 11 Apr 2026 |
| Broken access control CVE-2026-3360 | High 7.5 | Up to 3.9.7 | Fixed in a later version (latest 4.1.0) | 10 Apr 2026 |
| SQL injection CVE-2025-13673 | High 7.5 | Up to 3.9.6 | Fixed in a later version (latest 4.1.0) | 28 Feb 2026 |
| Broken access control CVE-2026-1371 | Medium 5.3 | Up to 3.9.5 | Fixed in a later version (latest 4.1.0) | 3 Feb 2026 |
| Broken access control CVE-2026-1375 | High 8.1 | Up to 3.9.5 | Fixed in a later version (latest 4.1.0) | 3 Feb 2026 |
| Broken access control CVE-2026-0548 | Medium 5.4 | Up to 3.9.4 | Fixed in a later version (latest 4.1.0) | 20 Jan 2026 |
| Broken access control CVE-2025-13934 | Medium 4.3 | Up to 3.9.3 | Fixed in a later version (latest 4.1.0) | 9 Jan 2026 |
| Broken access control CVE-2025-13935 | Medium 4.3 | Up to 3.9.2 | Fixed in a later version (latest 4.1.0) | 9 Jan 2026 |
| Broken access control CVE-2025-13628 | Medium 4.3 | Up to 3.9.3 | Fixed in a later version (latest 4.1.0) | 9 Jan 2026 |
| Broken access control CVE-2025-13679 | Medium 6.5 | Up to 3.9.3 | Fixed in a later version (latest 4.1.0) | 8 Jan 2026 |
| Broken access control CVE-2025-6639 | Medium 5.4 | Up to 3.8.3 | Fixed in a later version (latest 4.1.0) | 25 Oct 2025 |
| Sensitive data exposure CVE-2025-6680 | Medium 4.3 | Before 3.9.0 | Fixed in 3.9.0 | 25 Oct 2025 |
| Broken access control CVE-2025-11564 | Medium 5.3 | Before 3.9.0 | Fixed in 3.9.0 | 25 Oct 2025 |
| SQL injection CVE-2025-6184 | High 8.8 | Up to 3.7.0 | Fixed in a later version (latest 4.1.0) | 13 Aug 2025 |
| Broken access control CVE-2024-10393 | Medium 5.3 | Up to 2.7.6 | Fixed in a later version (latest 4.1.0) | 21 Nov 2024 |
| SQL injection CVE-2024-10400 | High 7.5 | Up to 2.7.6 | Fixed in a later version (latest 4.1.0) | 21 Nov 2024 |
| Cross-site request forgery (CSRF) CVE-2023-2919 | Medium 4.3 | Before 2.7.5 | Fixed in 2.7.5 | 10 Sep 2024 |
| Broken access control CVE-2024-5438 | Medium 4.3 | Before 2.7.2 | Fixed in 2.7.2 | 7 Jun 2024 |
| SQL injection CVE-2024-4902 | High 7.2 | Before 2.7.2 | Fixed in 2.7.2 | 7 Jun 2024 |
| Broken access control CVE-2024-4223 | Critical 9.8 | Before 2.7.1 | Fixed in 2.7.1 | 16 May 2024 |
| SQL injection CVE-2024-4318 | High 8.8 | Before 2.7.1 | Fixed in 2.7.1 | 16 May 2024 |
| Broken access control CVE-2024-4279 | Medium 6.5 | Before 2.7.1 | Fixed in 2.7.1 | 16 May 2024 |
| Broken access control CVE-2024-3553 | Medium 6.5 | Before 2.7.0 | Fixed in 2.7.0 | 2 May 2024 |
| Cross-site scripting (XSS) CVE-2024-3994 | Medium 5.4 | Before 2.7.0 | Fixed in 2.7.0 | 25 Apr 2024 |
| Broken access control CVE-2024-1502 | Medium 5.4 | Before 2.6.2 | Fixed in 2.6.2 | 21 Mar 2024 |
| Cross-site request forgery (CSRF) CVE-2024-1503 | Medium 4.3 | Before 2.6.2 | Fixed in 2.6.2 | 21 Mar 2024 |
| SQL injection CVE-2024-1751 | High 8.8 | Before 2.6.2 | Fixed in 2.6.2 | 13 Mar 2024 |
| Broken access control CVE-2024-1133 | Medium 4.3 | Before 2.6.1 | Fixed in 2.6.1 | 29 Feb 2024 |
| Cross-site scripting (XSS) CVE-2024-1128 | Medium 5.4 | Before 2.6.1 | Fixed in 2.6.1 | 29 Feb 2024 |
| Cross-site scripting (XSS) CVE-2023-4805 | Medium 5.4 | Before 2.3.0 | Fixed in 2.3.0 | 16 Oct 2023 |
| Security weakness CVE-2023-3133 | High 7.5 | Before 2.2.1 | Fixed in 2.2.1 | 4 Jul 2023 |
| Cross-site scripting (XSS) CVE-2023-0236 | Medium 6.1 | Before 2.0.10 | Fixed in 2.0.10 | 6 Feb 2023 |
| Cross-site scripting (XSS) CVE-2022-2563 | Medium 4.8 | Before 2.0.10 | Fixed in 2.0.10 | 17 Oct 2022 |
| Cross-site scripting (XSS) CVE-2021-25017 | Medium 6.1 | Before 1.9.12 | Fixed in 1.9.12 | 24 Jan 2022 |
| Cross-site scripting (XSS) CVE-2021-24873 | Medium 6.1 | Before 1.9.11 | Fixed in 1.9.11 | 23 Nov 2021 |
| Cross-site scripting (XSS) CVE-2021-24740 | Medium 4.8 | Before 1.9.9 | Fixed in 1.9.9 | 18 Oct 2021 |
| Cross-site scripting (XSS) CVE-2021-24455 | Medium 5.4 | Before 1.9.2 | Fixed in 1.9.2 | 2 Aug 2021 |
| File inclusion CVE-2021-24242 | Low 3.8 | Before 1.8.8 | Fixed in 1.8.8 | 22 Apr 2021 |
| Cross-site request forgery (CSRF) CVE-2020-8615 | Medium 6.5 | Before 1.5.3 | Fixed in 1.5.3 | 4 Feb 2020 |
Read the published descriptions
- CVE-2026-18439, 22 Sep 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows. CVE record
- CVE-2026-88944, 19 Sep 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts - including pages, courses, quizzes, and WooCommerce products - via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID. CVE record
- CVE-2026-89081, 19 Sep 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE record
- CVE-2026-89333, 19 Sep 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter. CVE record
- CVE-2026-85569, 16 Sep 2026
- The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it. CVE record
- CVE-2026-85572, 16 Sep 2026
- The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation. CVE record
- CVE-2026-78175, 12 Sep 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled. CVE record
- CVE-2026-16759, 28 Aug 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters. CVE record
- CVE-2026-19092, 27 Aug 2026
- The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. CVE record
- CVE-2026-19094, 26 Aug 2026
- The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large. CVE record
- CVE-2026-19093, 22 Aug 2026
- The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged. CVE record
- CVE-2026-14187, 22 Aug 2026
- The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors. CVE record
- CVE-2026-14306, 6 Aug 2026
- The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses. CVE record
- CVE-2026-14310, 30 Jul 2026
- The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them. CVE record
- CVE-2026-15444, 28 Jul 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2026-15022, 16 Jul 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain. CVE record
- CVE-2026-12271, 13 Jul 2026
- The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result. CVE record
- CVE-2026-12273, 13 Jul 2026
- The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue. CVE record
- CVE-2026-12274, 13 Jul 2026
- The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators. CVE record
- CVE-2026-12275, 13 Jul 2026
- The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active. CVE record
- CVE-2026-13443, 1 Jul 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2026-10736, 18 Jun 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2026-6965, 13 May 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content. CVE record
- CVE-2026-5502, 17 Apr 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site. CVE record
- CVE-2026-6080, 17 Apr 2026
- The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database. CVE record
- CVE-2026-3358, 11 Apr 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability. CVE record
- CVE-2026-3371, 11 Apr 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs. CVE record
- CVE-2026-3360, 10 Apr 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`. CVE record
- CVE-2025-13673, 28 Feb 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6. CVE record
- CVE-2026-1371, 3 Feb 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications. CVE record
- CVE-2026-1375, 3 Feb 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests. CVE record
- CVE-2026-0548, 20 Jan 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site. CVE record
- CVE-2025-13934, 9 Jan 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow. CVE record
- CVE-2025-13935, 9 Jan 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed. CVE record
- CVE-2025-13628, 9 Jan 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons. CVE record
- CVE-2025-13679, 8 Jan 2026
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address. CVE record
- CVE-2025-6639, 25 Oct 2025
- The Tutor LMS Pro - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students. CVE record
- CVE-2025-6680, 25 Oct 2025
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information. CVE record
- CVE-2025-11564, 25 Oct 2025
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'. CVE record
- CVE-2025-6184, 13 Aug 2025
- The Tutor LMS Pro - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected. CVE record
- CVE-2024-10393, 21 Nov 2024
- The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled. CVE record
- CVE-2024-10400, 21 Nov 2024
- The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2023-2919, 10 Sep 2024
- The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE record
- CVE-2024-5438, 7 Jun 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts. CVE record
- CVE-2024-4902, 7 Jun 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37256 is likely a duplicate of this issue. CVE record
- CVE-2024-4223, 16 May 2024
- The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data. CVE record
- CVE-2024-4318, 16 May 2024
- The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-4279, 16 May 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course. CVE record
- CVE-2024-3553, 2 May 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled. CVE record
- CVE-2024-3994, 25 Apr 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-1502, 21 Mar 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts. CVE record
- CVE-2024-1503, 21 Mar 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled. CVE record
- CVE-2024-1751, 13 Mar 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-1133, 29 Feb 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses. CVE record
- CVE-2024-1128, 29 Feb 2024
- The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting CVE record
- CVE-2023-4805, 16 Oct 2023
- The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2023-3133, 4 Jul 2023
- The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available. CVE record
- CVE-2023-0236, 6 Feb 2023
- The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin CVE record
- CVE-2022-2563, 17 Oct 2022
- The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2021-25017, 24 Jan 2022
- The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting CVE record
- CVE-2021-24873, 23 Nov 2021
- The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue CVE record
- CVE-2021-24740, 18 Oct 2021
- The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. CVE record
- CVE-2021-24455, 2 Aug 2021
- The Tutor LMS - eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin. CVE record
- CVE-2021-24242, 22 Apr 2021
- The Tutor LMS - eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file CVE record
- CVE-2020-8615, 4 Feb 2020
- A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors). CVE record
What to do if you run Tutor LMS
If you run Tutor LMS, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Tutor LMS vulnerabilities
Free. We email you when a new vulnerability is published for Tutor LMS, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.