WordPress plugin
Tutor LMS Pro security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High6
- Medium2
- Low0
All Tutor LMS Pro vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤3.9.8Update to 3.9.9 | CVE-2026-25406 | |
| Critical9.8 | Authentication Bypass via Social Login ≤3.9.5Update to 3.9.6 | CVE-2026-0953 | |
| High7.5 | Unauthenticated SQL Injection ≤3.9.6Update to 3.9.7 | CVE-2026-22332 | |
| Medium5.4 | Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments ≤3.8.3Update to 3.9.0 | CVE-2025-6639 | |
| High8.8 | Authenticated (Tutor Instructor+) SQL Injection ≤3.7.0Update to 3.7.1 | CVE-2025-6184 | |
| High7.1 | Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference ≤2.7.2Update to 2.7.3 | CVE-2024-5784 | |
| High8.8 | Missing Authorization to SQL Injection ≤2.7.0Update to 2.7.1 | CVE-2024-4352 | |
| High8.8 | Missing Authorization to Privilege Escalation ≤2.7.0Update to 2.7.1 | CVE-2024-4351 | |
| High7.3 | Missing Authorization ≤2.7.0Update to 2.7.1 | CVE-2024-4222 |
- Medium5.3Missing Authorization
≤3.9.8Update to 3.9.9
- Critical9.8Authentication Bypass via Social Login
≤3.9.5Update to 3.9.6
- High7.5Unauthenticated SQL Injection
≤3.9.6Update to 3.9.7
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments
≤3.8.3Update to 3.9.0
- High8.8Authenticated (Tutor Instructor+) SQL Injection
≤3.7.0Update to 3.7.1
- High7.1Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.7.2Update to 2.7.3
- High8.8Missing Authorization to SQL Injection
≤2.7.0Update to 2.7.1
- High8.8Missing Authorization to Privilege Escalation
≤2.7.0Update to 2.7.1
- High7.3Missing Authorization
≤2.7.0Update to 2.7.1
Tutor LMS Pro: common questions
Does Tutor LMS Pro have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Tutor LMS Pro: 1 critical, 6 high, 2 medium. None are known to affect version null.
How do I check which version of Tutor LMS Pro I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Tutor LMS Pro vulnerability?
CVE-2026-25406, published Mar 23, 2026: Tutor LMS Pro <= 3.9.8 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Tutor LMS Pro vulnerability listed in CISA KEV?
No. None of the known Tutor LMS Pro vulnerabilities is currently listed in the CISA KEV catalog.