CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 is vulnerable to template variable shadowing : request data can overwrite internal variables during template rendering, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. This yields a CVSS 3.1 score...