CVE-2026-19092

The Tutor LMS WordPress plugin prior to version 4.0.6 is vulnerable to a critical security flaw that allows unauthenticated users to overwrite internal variables during template rendering, enabling the execution of arbitrary zero-argument PHP functions. This could lead to unauthorized access to sensitive information or system compromise. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of exploitation.