Tutor LMS vulnerabilities
We track 3 vulnerabilities in Tutor LMS products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Tutor LMS vulnerabilities
- 7.5 High severity
Tutor LMS: Missing Authorization
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the
- 7.2 High severity
Tutor LMS: Improper Privilege Management
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the
- 9.8 Critical severity
Tutor LMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.