Executive brief
Tutor LMS is a popular WordPress plugin for creating and managing online courses. The plugin fails to properly validate user input when rendering templates, allowing unauthenticated attackers to invoke arbitrary PHP functions without arguments and retrieve their output. This can result in session destruction, deletion of critical WordPress settings, database table corruption, or exposure of sensitive information.
Technical details
The vulnerability is a variable shadowing / injection flaw in template rendering logic. Request data (GET/POST parameters) can overwrite internal template variables without validation, allowing attackers to control which PHP function gets invoked during template rendering. Since the vulnerability permits only zero-argument function calls, attackers are limited to functions that can be called without parameters, but this includes dangerous functions like wp_destroy_all_sessions(), delete_option(), and potentially direct database manipulation functions. The attack is network-reachable and requires no authentication. Tutor LMS versions before 4.0.6 are affected; the fix restricts request data from shadowing template variables.
Affected products
- Themeum Tutor LMS before 4.0.6
Timeline
- 2026-08-26: disclosed
- 2026-08-27: patched: Version 4.0.6 released with fix