Tutor LMS CVE-2026-19092

No authentication, user interaction, or special privileges are required (CVSS PR:N/UI:N/AC:L), so a default installation of any Tutor LMS version prior to 4.0.6 is exploitable by remote unauthenticated users over the network. The specific prerequisite is reaching a plugin code path that renders a template where request data is allowed to overwrite the internal variable later used as a callable. The key limiting factor is the zero-argument constraint: an attacker can only invoke PHP functions that require no parameters, so the achievable impact is capped by which such functions are reachable in scope rather than being unrestricted code execution. The only deployment requirement is running a vulnerable plugin version (< 4.0.6) on an internet-reachable WordPress site.

This is a genuine high-priority issue rather than an inflated CVSS score. All signals align toward network-reachable, pre-authentication exploitation: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity, and public exploit code exists per WPScan. The practical impact is bounded by the zero-argument constraint - attackers can only call functions that need no parameters (e.g. phpinfo, getcwd, get_current_user, sys_getloadavg), so this is more precisely an information-disclosure and reconnaissance primitive than a guaranteed remote code execution, which tempers the C:H/I:H/A:H rating somewhat. No EPSS score and no KEV listing were provided, so widespread automated exploitation is not confirmed; however, given a public PoC and the enormous WordPress attack surface, mass scanning is plausible and any operator running an affected version should treat patching as urgent regardless of size. Overall: real, credible, and easy to exploit, but the ceiling of impact depends on which callable functions are reachable in the plugin's runtime context.

An unauthenticated attacker sends a crafted HTTP request to an affected Tutor LMS page, supplying a parameter that overwrites the internal template variable used as a callable and naming a zero-argument PHP function such as phpinfo or getcwd. The server executes the function and returns its output in the response, leaking configuration and environment details the attacker uses for further reconnaissance. A public proof-of-concept from WPScan lowers the skill barrier, and the low-complexity network vector makes opportunistic scanning realistic.