CVE-2026-19092
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Aug 27, 2026
Vendor
unknown
Description
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.