{"id":"CVE-2026-19092","aliases":["EUVD-2026-67242","GHSA-2rmp-5m77-4x47"],"status":"published","title":"Tutor LMS \u003c 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing","description":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02624,"percentile":0.85681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2026-08-27T17:05:37Z","modified":"2026-08-28T18:43:25Z","exploits":[{"source":"nuclei","id":"CVE-2026-19092","title":"Tutor LMS \u003c 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19092.yaml"}],"products":[{"vendor":"themeum","product":"tutor lms"},{"vendor":"unknown","product":"tutor lms"}],"references":[{"url":"https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19092"},{"url":"https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56"},{"url":"https://github.com/advisories/GHSA-2rmp-5m77-4x47"}],"sources":{"cve":[{"id":"CVE-2026-19092","title":"Tutor LMS \u003c 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing","description":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.","status":"published","published":"2026-08-27T17:05:37.621Z","modified":"2026-08-28T13:03:21.752Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-67242","description":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.","status":"published","published":"2026-08-27T17:05:37Z","modified":"2026-08-28T13:03:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:23.608347Z"}],"ghsa":[{"id":"GHSA-2rmp-5m77-4x47","title":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting...","description":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.","status":"published","published":"2026-08-27T21:31:30Z","modified":"2026-08-28T18:31:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:11:07.541511Z"}],"nvd":[{"id":"CVE-2026-19092","description":"The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.","status":"published","published":"2026-08-27T20:17:04.15Z","modified":"2026-08-28T18:43:25.883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:12:42.035353Z"}]}}