{"schema_version":1,"title":"Themeum Tutor LMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in Themeum Tutor LMS: 1 in the last 7 days and 20 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-18439, was published on 22 September 2026.","url":"https://junglewise.ai/threats/technologies/tutor-lms","json_url":"https://junglewise.ai/threats/technologies/tutor-lms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/tutor-lms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":23,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":8,"last_90_days":20,"last_365_days":23},"latest":[{"cve":"CVE-2026-18439","cvss":4.3,"epss":0.0025,"slug":"cve-2026-18439-the-tutor-lms-elearning-and-online-course-solution-plugin-for","title":"Tutor LMS insecure direct object reference in quiz builder","severity":"medium","exploited":false,"published_at":"2026-09-22T08:16:39.08+00:00","url":"https://junglewise.ai/threats/cve-2026-18439-the-tutor-lms-elearning-and-online-course-solution-plugin-for"},{"cve":"CVE-2026-89081","cvss":6.1,"epss":0.0038,"slug":"cve-2026-89081-the-tutor-lms-elearning-and-online-course-solution-plugin-for","title":"Tutor LMS reflected cross-site scripting in search parameter","severity":"medium","exploited":false,"published_at":"2026-09-19T03:17:16.303+00:00","url":"https://junglewise.ai/threats/cve-2026-89081-the-tutor-lms-elearning-and-online-course-solution-plugin-for"},{"cve":"CVE-2026-88944","cvss":4.3,"epss":0.0046,"slug":"cve-2026-88944-the-tutor-lms-elearning-and-online-course-solution-plugin-for","title":"Tutor LMS authorization bypass in post deletion","severity":"medium","exploited":false,"published_at":"2026-09-19T03:17:16+00:00","url":"https://junglewise.ai/threats/cve-2026-88944-the-tutor-lms-elearning-and-online-course-solution-plugin-for"},{"cve":"CVE-2026-85572","cvss":4.3,"epss":0.003,"slug":"cve-2026-85572-tutor-lms-improper-access-control-in-lesson-discussion-content","title":"Tutor LMS improper access control in lesson discussion content","severity":"medium","exploited":false,"published_at":"2026-09-16T06:16:34.31+00:00","url":"https://junglewise.ai/threats/cve-2026-85572-tutor-lms-improper-access-control-in-lesson-discussion-content"},{"cve":"CVE-2026-85569","cvss":7.2,"epss":0.0046,"slug":"cve-2026-85569-tutor-lms-privilege-escalation-via-rest-api-request","title":"Tutor LMS privilege escalation via REST API request misclassification","severity":"high","exploited":false,"published_at":"2026-09-16T06:16:34.217+00:00","url":"https://junglewise.ai/threats/cve-2026-85569-tutor-lms-privilege-escalation-via-rest-api-request"},{"cve":"CVE-2026-78175","cvss":8.8,"epss":0.0107,"slug":"cve-2026-78175-tutor-lms-php-object-injection-in-withdraw-method-handler","title":"Tutor LMS PHP Object Injection in withdraw method handler","severity":"high","exploited":false,"published_at":"2026-09-12T08:16:24.507+00:00","url":"https://junglewise.ai/threats/cve-2026-78175-tutor-lms-php-object-injection-in-withdraw-method-handler"},{"cve":"CVE-2026-16759","cvss":6.5,"epss":0.0062,"slug":"cve-2026-16759-tutor-lms-remote-code-execution-via-ajax-filter","title":"Tutor LMS Remote Code Execution via AJAX filter","severity":"medium","exploited":false,"published_at":"2026-08-28T05:16:41.66+00:00","url":"https://junglewise.ai/threats/cve-2026-16759-tutor-lms-remote-code-execution-via-ajax-filter"},{"cve":"CVE-2026-19092","cvss":9.8,"epss":0.02,"slug":"cve-2026-19092-tutor-lms-plugin-arbitrary-function-invocation-in-template","title":"Tutor LMS plugin arbitrary function invocation in template rendering","severity":"critical","exploited":false,"published_at":"2026-08-27T20:17:04.15+00:00","url":"https://junglewise.ai/threats/cve-2026-19092-tutor-lms-plugin-arbitrary-function-invocation-in-template"},{"cve":"CVE-2026-19094","cvss":5.3,"epss":0.0022,"slug":"cve-2026-19094-tutor-lms-sql-injection-in-q-a-template","title":"Tutor LMS SQL injection in Q&A template","severity":"medium","exploited":false,"published_at":"2026-08-26T06:16:25.6+00:00","url":"https://junglewise.ai/threats/cve-2026-19094-tutor-lms-sql-injection-in-q-a-template"},{"cve":"CVE-2026-19093","cvss":6.8,"epss":0.0046,"slug":"cve-2026-19093-tutor-lms-arbitrary-file-read-in-video-path-validation","title":"Tutor LMS arbitrary file read in video path validation","severity":"medium","exploited":false,"published_at":"2026-08-22T06:16:15.9+00:00","url":"https://junglewise.ai/threats/cve-2026-19093-tutor-lms-arbitrary-file-read-in-video-path-validation"},{"cve":"CVE-2026-14187","cvss":2.7,"epss":0.003,"slug":"cve-2026-14187-tutor-lms-privilege-escalation-via-idor-in-course-access-control","title":"Tutor LMS privilege escalation via IDOR in course access control","severity":"low","exploited":false,"published_at":"2026-08-22T06:16:11.597+00:00","url":"https://junglewise.ai/threats/cve-2026-14187-tutor-lms-privilege-escalation-via-idor-in-course-access-control"},{"cve":"CVE-2026-14310","cvss":5.4,"slug":"cve-2026-14310-themeum-tutor-lms-idor-in-q-a-threads","title":"Themeum Tutor LMS IDOR in Q&A threads","severity":"info","exploited":false,"published_at":"2026-07-30T06:25:00.567+00:00","url":"https://junglewise.ai/threats/cve-2026-14310-themeum-tutor-lms-idor-in-q-a-threads"},{"cve":"CVE-2026-15444","cvss":4.9,"slug":"cve-2026-15444-themeum-tutor-lms-sql-injection-in-coupon-code","title":"Themeum Tutor LMS SQL injection in coupon_code","severity":"medium","exploited":false,"published_at":"2026-07-28T12:16:35.767+00:00","url":"https://junglewise.ai/threats/cve-2026-15444-themeum-tutor-lms-sql-injection-in-coupon-code"},{"cve":"CVE-2026-15022","cvss":6.5,"slug":"cve-2026-15022-themeum-tutor-lms-sql-injection-in-stored-quiz-answer-array","title":"Themeum Tutor LMS SQL injection in Stored Quiz Answer Array","severity":"medium","exploited":false,"published_at":"2026-07-16T09:16:17.44+00:00","url":"https://junglewise.ai/threats/cve-2026-15022-themeum-tutor-lms-sql-injection-in-stored-quiz-answer-array"},{"cve":"CVE-2026-57694","cvss":6.5,"slug":"cve-2026-57694-themeum-tutor-lms-idor-authorization-bypass","title":"Themeum Tutor LMS IDOR authorization bypass","severity":"medium","exploited":false,"published_at":"2026-07-13T10:16:36.893+00:00","url":"https://junglewise.ai/threats/cve-2026-57694-themeum-tutor-lms-idor-authorization-bypass"},{"cve":"CVE-2026-12275","cvss":5.4,"slug":"cve-2026-12275-themeum-tutor-lms-auth-bypass-in-droip-and-kirki-integrations","title":"Themeum Tutor LMS auth bypass in Droip and Kirki integrations","severity":"info","exploited":false,"published_at":"2026-07-13T07:16:27.923+00:00","url":"https://junglewise.ai/threats/cve-2026-12275-themeum-tutor-lms-auth-bypass-in-droip-and-kirki-integrations"},{"cve":"CVE-2026-12274","cvss":8.8,"slug":"cve-2026-12274-tutor-lms-idor-in-content-builder-save-handler","title":"Tutor LMS IDOR in content-builder save handler","severity":"info","exploited":false,"published_at":"2026-07-13T07:16:27.83+00:00","url":"https://junglewise.ai/threats/cve-2026-12274-tutor-lms-idor-in-content-builder-save-handler"},{"cve":"CVE-2026-12273","cvss":4.3,"slug":"cve-2026-12273-themeum-tutor-lms-authorization-bypass-in-comment-handler","title":"Themeum Tutor LMS authorization bypass in comment handler","severity":"info","exploited":false,"published_at":"2026-07-13T07:16:27.733+00:00","url":"https://junglewise.ai/threats/cve-2026-12273-themeum-tutor-lms-authorization-bypass-in-comment-handler"},{"cve":"CVE-2026-12271","cvss":5.4,"slug":"cve-2026-12271-themeum-tutor-lms-idor-in-quiz-attempt-modification","title":"Themeum Tutor LMS IDOR in quiz attempt modification","severity":"info","exploited":false,"published_at":"2026-07-13T07:16:27.62+00:00","url":"https://junglewise.ai/threats/cve-2026-12271-themeum-tutor-lms-idor-in-quiz-attempt-modification"},{"cve":"CVE-2026-13443","cvss":6.4,"slug":"cve-2026-13443-themeum-tutor-lms-stored-xss-in-lesson-attachment-title","title":"Themeum Tutor LMS stored XSS in Lesson Attachment Title","severity":"medium","exploited":false,"published_at":"2026-07-01T05:16:18.513+00:00","url":"https://junglewise.ai/threats/cve-2026-13443-themeum-tutor-lms-stored-xss-in-lesson-attachment-title"},{"cve":"CVE-2026-10736","cvss":4.9,"epss":0.0036,"slug":"cve-2026-10736-themeum-tutor-lms-sql-injection-in-data-parameter","title":"Themeum Tutor LMS SQL injection in data parameter","severity":"medium","exploited":false,"published_at":"2026-06-18T06:16:56.573+00:00","url":"https://junglewise.ai/threats/cve-2026-10736-themeum-tutor-lms-sql-injection-in-data-parameter"},{"cve":"CVE-2026-40743","cvss":6.5,"slug":"cve-2026-40743-themeum-tutor-lms-broken-access-control","title":"Themeum Tutor LMS broken access control","severity":"medium","exploited":false,"published_at":"2026-06-15T21:16:49.003+00:00","url":"https://junglewise.ai/threats/cve-2026-40743-themeum-tutor-lms-broken-access-control"},{"cve":"CVE-2026-6965","cvss":5.3,"slug":"cve-2026-6965-themeum-tutor-lms-idor-in-get-course-id-by-function","title":"Themeum Tutor LMS IDOR in get_course_id_by function","severity":"medium","exploited":false,"published_at":"2026-05-13T06:16:15.087+00:00","url":"https://junglewise.ai/threats/cve-2026-6965-themeum-tutor-lms-idor-in-get-course-id-by-function"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":3},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[{"name":"Themeum Kirki","slug":"kirki","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/kirki"}],"technology":{"hub":true,"name":"Themeum Tutor LMS","slug":"tutor-lms","vendor":{"name":"Themeum","slug":"themeum","url":"https://junglewise.ai/threats/vendors/themeum"},"aliases":[],"category":"library","homepage":"https://www.themeum.com/product/tutor-lms/","repo_url":"https://github.com/themeum/tutor-lms","description":"Tutor LMS is a learning management system plugin for WordPress used to create and manage online courses.","url":"https://junglewise.ai/threats/technologies/tutor-lms"},"most_severe":[{"cve":"CVE-2026-19092","cvss":9.8,"epss":0.02,"slug":"cve-2026-19092-tutor-lms-plugin-arbitrary-function-invocation-in-template","title":"Tutor LMS plugin arbitrary function invocation in template rendering","severity":"critical","exploited":false,"published_at":"2026-08-27T20:17:04.15+00:00","url":"https://junglewise.ai/threats/cve-2026-19092-tutor-lms-plugin-arbitrary-function-invocation-in-template"},{"cve":"CVE-2026-78175","cvss":8.8,"epss":0.0107,"slug":"cve-2026-78175-tutor-lms-php-object-injection-in-withdraw-method-handler","title":"Tutor LMS PHP Object Injection in withdraw method handler","severity":"high","exploited":false,"published_at":"2026-09-12T08:16:24.507+00:00","url":"https://junglewise.ai/threats/cve-2026-78175-tutor-lms-php-object-injection-in-withdraw-method-handler"},{"cve":"CVE-2026-85569","cvss":7.2,"epss":0.0046,"slug":"cve-2026-85569-tutor-lms-privilege-escalation-via-rest-api-request","title":"Tutor LMS privilege escalation via REST API request misclassification","severity":"high","exploited":false,"published_at":"2026-09-16T06:16:34.217+00:00","url":"https://junglewise.ai/threats/cve-2026-85569-tutor-lms-privilege-escalation-via-rest-api-request"},{"cve":"CVE-2026-19093","cvss":6.8,"epss":0.0046,"slug":"cve-2026-19093-tutor-lms-arbitrary-file-read-in-video-path-validation","title":"Tutor LMS arbitrary file read in video path validation","severity":"medium","exploited":false,"published_at":"2026-08-22T06:16:15.9+00:00","url":"https://junglewise.ai/threats/cve-2026-19093-tutor-lms-arbitrary-file-read-in-video-path-validation"},{"cve":"CVE-2026-16759","cvss":6.5,"epss":0.0062,"slug":"cve-2026-16759-tutor-lms-remote-code-execution-via-ajax-filter","title":"Tutor LMS Remote Code Execution via AJAX filter","severity":"medium","exploited":false,"published_at":"2026-08-28T05:16:41.66+00:00","url":"https://junglewise.ai/threats/cve-2026-16759-tutor-lms-remote-code-execution-via-ajax-filter"},{"cve":"CVE-2026-15022","cvss":6.5,"slug":"cve-2026-15022-themeum-tutor-lms-sql-injection-in-stored-quiz-answer-array","title":"Themeum Tutor LMS SQL injection in Stored Quiz Answer Array","severity":"medium","exploited":false,"published_at":"2026-07-16T09:16:17.44+00:00","url":"https://junglewise.ai/threats/cve-2026-15022-themeum-tutor-lms-sql-injection-in-stored-quiz-answer-array"},{"cve":"CVE-2026-57694","cvss":6.5,"slug":"cve-2026-57694-themeum-tutor-lms-idor-authorization-bypass","title":"Themeum Tutor LMS IDOR authorization bypass","severity":"medium","exploited":false,"published_at":"2026-07-13T10:16:36.893+00:00","url":"https://junglewise.ai/threats/cve-2026-57694-themeum-tutor-lms-idor-authorization-bypass"},{"cve":"CVE-2026-40743","cvss":6.5,"slug":"cve-2026-40743-themeum-tutor-lms-broken-access-control","title":"Themeum Tutor LMS broken access control","severity":"medium","exploited":false,"published_at":"2026-06-15T21:16:49.003+00:00","url":"https://junglewise.ai/threats/cve-2026-40743-themeum-tutor-lms-broken-access-control"},{"cve":"CVE-2026-13443","cvss":6.4,"slug":"cve-2026-13443-themeum-tutor-lms-stored-xss-in-lesson-attachment-title","title":"Themeum Tutor LMS stored XSS in Lesson Attachment Title","severity":"medium","exploited":false,"published_at":"2026-07-01T05:16:18.513+00:00","url":"https://junglewise.ai/threats/cve-2026-13443-themeum-tutor-lms-stored-xss-in-lesson-attachment-title"},{"cve":"CVE-2026-89081","cvss":6.1,"epss":0.0038,"slug":"cve-2026-89081-the-tutor-lms-elearning-and-online-course-solution-plugin-for","title":"Tutor LMS reflected cross-site scripting in search parameter","severity":"medium","exploited":false,"published_at":"2026-09-19T03:17:16.303+00:00","url":"https://junglewise.ai/threats/cve-2026-89081-the-tutor-lms-elearning-and-online-course-solution-plugin-for"}],"generated_at":"2026-09-26T12:07:00.15149+00:00"}