WordPress plugin
Tutor LMS – eLearning and online course solution security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High19
- Medium79
- Low1
All Tutor LMS – eLearning and online course solution vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.1.0Update to 4.1.1
- High8.8Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
≤4.0.7Update to 4.0.8
- Critical9.8Unauthenticated Arbitrary Zero-Argument Function Invocation
≤4.0.5Update to 4.0.6
- High7.5Unauthenticated SQL Injection
<4.0.6Update to 4.0.6
- High7.5Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
≤3.9.7Update to 3.9.8
- High7.5Unauthenticated SQL Injection via coupon_code
≤3.9.6Update to 3.9.7
- High8.1Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
≤3.9.5Update to 3.9.6
- High7.5Unauthenticated SQL Injection via rating_filter
≤2.7.6Update to 2.7.7
- High7.2Authenticated (Administrator+) SQL Injection
≤2.7.2Update to 2.7.3
- High7.2Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
≤2.7.1Update to 2.7.2
- High8.8Authenticated (Instructor+) SQL Injection
≤2.7.0Update to 2.7.1
- Critical9.8Missing Authorization
≤2.7.0Update to 2.7.1
- High8.8Authenticated (Subscriber+) SQL Injection
≤2.6.1Update to 2.6.2
- High7.5Missing Authorization via REST API
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Tutor Instructor+) SQL Injection
≤2.1.10Update to 2.2.0
- Critical9.8Unauthenticated SQL Injection
≤2.1.10Update to 2.2.0
- High8.8Authenticated (Student+) SQL Injection
≤2.2.0Update to 2.2.1
- High7.2Stored Cross-Site Scripting
≤1.9.11Update to 1.9.12
- High8.8SQL Injection via tutor_quiz_builder_get_answers_by_question
≤1.8.2Update to 1.8.3
- High8.8SQL Injection via tutor_answering_quiz_question/get_answer_by_id
<1.8.3Update to 1.8.3
- High8.8Unprotected AJAX including Privilege Escalation
<1.7.7Update to 1.7.7
- High8.8Cross-Site Request Forgery
<1.5.3Update to 1.5.3
Tutor LMS – eLearning and online course solution: common questions
Does Tutor LMS – eLearning and online course solution have known vulnerabilities?
Yes. VulnCrest Radar lists 102 known vulnerabilities in Tutor LMS – eLearning and online course solution: 3 critical, 19 high, 79 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Tutor LMS – eLearning and online course solution I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Tutor LMS – eLearning and online course solution vulnerability?
CVE-2026-93779, published Nov 6, 2026: Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints. Severity: Medium (CVSS 6.5).
Is any Tutor LMS – eLearning and online course solution vulnerability listed in CISA KEV?
No. None of the known Tutor LMS – eLearning and online course solution vulnerabilities is currently listed in the CISA KEV catalog.