WordPress plugin
Tutor LMS – eLearning and online course solution security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High19
- Medium79
- Low1
All Tutor LMS – eLearning and online course solution vulnerabilities
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints
≤4.1.2Update to 4.1.3
- Medium4.34.1.3 - Authenticated (Subscriber+) Information Exposure
1.6.4 – 4.1.3Update to 4.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.1.2Update to 4.1.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
≤4.1.0Update to 4.1.1
- Medium6.1Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
≤4.0.8Update to 4.0.9
- Medium4.7Reflected Cross-Site Scripting via 'tab' Parameter
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization
≤4.1.0Update to 4.1.1
- Medium4.3Authenticated (Subscriber+) Race Condition
≤4.1.2No patch available
- Medium4.34.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
4.0.5 – 4.1.0Update to 4.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.1.0Update to 4.1.1
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
≤4.0.7Update to 4.0.8
- Medium6.1Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
≤4.0.8Update to 4.0.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
≤4.0.8Update to 4.0.9
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
≤4.0.8Update to 4.0.9
- Medium4.34.0.7 - REST API Authentication Confusion
≤4.0.7Update to 4.0.8
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.0.7Update to 4.0.8
- High8.8Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
≤4.0.7Update to 4.0.8
- Medium6.5Authenticated (Custom Role+) Arbitrary File Read
<4.0.6Update to 4.0.6
- Medium6.5Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
≤4.0.5Update to 4.0.6
- Critical9.8Unauthenticated Arbitrary Zero-Argument Function Invocation
≤4.0.5Update to 4.0.6
- High7.5Unauthenticated SQL Injection
<4.0.6Update to 4.0.6
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
≤4.0.5Update to 4.0.6
- Medium4.3Missing Authorization
<4.0.0Update to 4.0.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
≤4.0.1Update to 4.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
≤4.0.0Update to 4.0.1
- Medium4.3Unauthenticated Insecure Direct Object Reference
≤3.9.13Update to 3.9.14
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.9.13Update to 3.9.14
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
≤3.9.13Update to 3.9.14
- Medium4.3Authenticated (Subscriber+) Information Disclosure
≤3.9.12Update to 3.9.13
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
≤3.9.12Update to 3.9.13
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Comment Creation
≤3.9.12Update to 3.9.13
- Medium4.9Authenticated (Administrator+) SQL Injection via 'data' Parameter
≤3.9.11Update to 3.9.12
- Medium5.3Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
≤3.9.9Update to 3.9.10
- Medium5.3Missing Authorization
≤3.9.7Update to 3.9.8
- Medium6.5Authenticated (Admin+) SQL Injection via 'date' Parameter
≤3.9.8Update to 3.9.9
- Medium5.3Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
≤3.9.8Update to 3.9.9
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
≤3.9.7Update to 3.9.8
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
≤3.9.7Update to 3.9.8
- High7.5Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
≤3.9.7Update to 3.9.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.9.4Update to 3.9.5
- Medium4.3Missing Authorization
≤3.9.7Update to 3.9.8
- High7.5Unauthenticated SQL Injection via coupon_code
≤3.9.6Update to 3.9.7
- Medium4.3Missing Authorization
≤3.9.5Update to 3.9.6
- Medium5.3Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
≤3.9.5Update to 3.9.6
- High8.1Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
≤3.9.5Update to 3.9.6
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
≤3.9.4Update to 3.9.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
≤3.9.3Update to 3.9.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
≤3.9.2Update to 3.9.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
≤3.9.3Update to 3.9.4
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
≤3.9.3Update to 3.9.4
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
≤3.9.4Update to 3.9.5
- Medium4.3Missing Authorization to Sensitive Information Exposure
≤3.8.3Update to 3.9.0
- Medium5.3Missing Authorization to Unauthenticated Payment Status Update
≤3.8.3Update to 3.9.0
- Medium4.9Authenticated (Administrator+) SQL Injection
≤3.7.4Update to 3.8.0
- Medium4.3Authenticated (Subscriber+) HTML Injection
≤3.4.0Update to 3.4.1
- High7.5Unauthenticated SQL Injection via rating_filter
≤2.7.6Update to 2.7.7
- Medium5.3User Registration Setting Bypass to Unauthorized User Registration
≤2.7.6Update to 2.7.7
- Medium4.3Cross-Site Request Forgery via 'addon_enable_disable'
≤2.7.4Update to 2.7.5
- High7.2Authenticated (Administrator+) SQL Injection
≤2.7.2Update to 2.7.3
- Medium5.5Authenticated (Instructor+) Stored Cross-Site Scripting
≤2.7.3Update to 2.7.4
- Medium5.3Missing Authorization
≤2.7.3Update to 2.7.4
- Medium4.3Cross-Site Request Forgery
≤2.7.2Update to 2.7.3
- Medium5.5Authenticated (Tutor Instructor+) Stored Cross-Site Scripting
≤2.7.2Update to 2.7.3
- Low2.7Authenticated (Admin+) Path Traversal
≤2.7.1Update to 2.7.2
- High7.2Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
≤2.7.1Update to 2.7.2
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
≤2.7.1Update to 2.7.2
- Medium6.5Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
≤2.7.0Update to 2.7.1
- High8.8Authenticated (Instructor+) SQL Injection
≤2.7.0Update to 2.7.1
- Critical9.8Missing Authorization
≤2.7.0Update to 2.7.1
- Medium6.5Missing Authorization to Unauthenticated Limited Options Update
≤2.6.2Update to 2.7.0
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
≤2.6.2Update to 2.7.0
- Medium4.3Cross-Site Request Forgery to Plugin Deactivation and Data Erase
≤2.6.1Update to 2.6.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
≤2.6.1Update to 2.6.2
- High8.8Authenticated (Subscriber+) SQL Injection
≤2.6.1Update to 2.6.2
- Medium5.4Authenticated(Student+) HTML Injection via Q&A
≤2.6.0Update to 2.6.1
- Medium4.3Missing Authorization
≤2.6.0Update to 2.6.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.2.4Update to 2.3.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.2.4Update to 2.3.0
- High7.5Missing Authorization via REST API
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Tutor Instructor+) SQL Injection
≤2.1.10Update to 2.2.0
- Critical9.8Unauthenticated SQL Injection
≤2.1.10Update to 2.2.0
- High8.8Authenticated (Student+) SQL Injection
≤2.2.0Update to 2.2.1
- Medium5.4Missing Authorization via multiple AJAX actions
≤2.1.8Update to 2.1.9
- Medium6.1Reflected Cross-Site Scripting
≤2.0.9Update to 2.0.10
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.0.9Update to 2.0.10
- Medium6.1Reflected Cross-Site Scripting
2.0.0 – 2.0.8Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
≤1.9.11Update to 1.9.12
- High7.2Stored Cross-Site Scripting
≤1.9.11Update to 1.9.12
- Medium6.1Reflected Cross-Site Scripting
≤1.9.10Update to 1.9.11
- Medium5.5Admin+ Stored Cross-Site Scripting
<1.9.9Update to 1.9.9
- Medium6.1Cross-Site Scripting
≤1.9.5Update to 1.9.6
- Medium5.5Authenticated Stored Cross-Site Scripting
≤1.9.1Update to 1.9.2
- Medium5.5Authenticated Local File Inclusion
≤1.8.7Update to 1.8.8
- Medium6.5SQL Injection
<1.7.7Update to 1.7.7
- High8.8SQL Injection via tutor_quiz_builder_get_answers_by_question
≤1.8.2Update to 1.8.3
- High8.8SQL Injection via tutor_answering_quiz_question/get_answer_by_id
<1.8.3Update to 1.8.3
- Medium6.5SQL Injection via tutor_quiz_builder_get_question_form
≤1.8.2Update to 1.8.3
- High8.8Unprotected AJAX including Privilege Escalation
<1.7.7Update to 1.7.7
- Medium6.5SQL Injection
<1.7.7Update to 1.7.7
- Medium6.1Reflected Cross-Site Scripting
≤1.9.12Update to 1.9.13
- High8.8Cross-Site Request Forgery
<1.5.3Update to 1.5.3
Tutor LMS – eLearning and online course solution: common questions
Does Tutor LMS – eLearning and online course solution have known vulnerabilities?
Yes. VulnCrest Radar lists 102 known vulnerabilities in Tutor LMS – eLearning and online course solution: 3 critical, 19 high, 79 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Tutor LMS – eLearning and online course solution I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Tutor LMS – eLearning and online course solution vulnerability?
CVE-2026-93779, published Nov 6, 2026: Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints. Severity: Medium (CVSS 6.5).
Is any Tutor LMS – eLearning and online course solution vulnerability listed in CISA KEV?
No. None of the known Tutor LMS – eLearning and online course solution vulnerabilities is currently listed in the CISA KEV catalog.