Quick answers
- Is CVE-2026-19094 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19094 being exploited in the wild.
- How severe is CVE-2026-19094?
- Medium severity, with a CVSS score of 5.3, published 26 August 2026.
- Which products and versions are affected?
- Tutor Tutor LMS before 4.0.6.
- Is there a fix for CVE-2026-19094?
- A patch was published on 2026-08-26: Fixed in version 4.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19094 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19094?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin fails to validate the 'offset' and 'item_per_page' parameters before using them to construct SQL queries in the Q&A listing template. The injected text reaches the SQL parser as grammar rather than as parameterized data, allowing unauthenticated users to manipulate query logic. The attacker can inject valid SQL clauses to override the application's own query conditions and bypass access restrictions on private courses. While the vulnerability does not permit arbitrary database extraction, it specifically discloses question and answer content from non-public courses that would otherwise be inaccessible. The vulnerability was patched in version 4.0.6.
Affected products
- Tutor Tutor LMS before 4.0.6
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 4.0.6