Description

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T20:17:04.150Z",
  "pubdate": "2026-08-27T20:17:04.150Z",
  "executiveSummary": "Tutor LMS WordPress plugin versions prior to 4.0.6 are vulnerable to an arbitrary function execution flaw resulting from improper input validation during template rendering. This vulnerability allows an unauthenticated remote attacker to influence internal variable state by injecting request data that overwrites legitimate variables. By controlling these variables, an attacker can invoke arbitrary PHP functions that do not require arguments, subsequently capturing and exfiltrating the function's return output.\nThe vulnerability represents a critical security risk, as it permits unauthorized code execution within the context of the WordPress environment. An attacker does not require prior authentication or elevated privileges to exploit this flaw, making it highly accessible for exploitation. The potential impact includes unauthorized information disclosure, sensitive data exfiltration, or further system compromise depending on the reachable PHP functions available in the application scope. Organizations using Tutor LMS are strongly advised to update to version 4.0.6 or later to remediate the underlying flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure template rendering process within the Tutor LMS plugin, where user-supplied input from HTTP request parameters is permitted to overwrite internal application variables. This represents a classic case of improper input sanitization and object property injection, where the application fails to distinguish between legitimate internal state data and malicious user-controlled input.\nThe attack flow begins when an unauthenticated attacker sends a crafted HTTP request containing specially formatted parameters designed to manipulate the internal variable space during the template rendering execution cycle. Because the plugin does not implement proper scope isolation or input validation, these injected parameters are parsed by the template engine, allowing the attacker to redefine variables used in function calls or logic paths.\nBy manipulating these variables, the attacker can force the application to call unintended PHP functions. Specifically, the vulnerability allows for the invocation of any PHP function that does not require arguments. When the template rendering process executes these manipulated function calls, the return output of the function—which may contain sensitive internal data, configuration information, or object details—is rendered and returned in the HTTP response body, facilitating unauthorized disclosure.\nThis vulnerability is classified as an arbitrary function execution flaw, potentially mapping to CWE-94 (Improper Control of Generation of Code). The impact is significant because it allows an attacker to interact with the server-side runtime environment without requiring any legitimate credentials. Because the attack occurs at the network level and requires no specific privilege, it is readily exploitable by remote actors. The post-exploitation impact is limited by the set of available PHP functions and the application's configuration, but the exposure of internal application state often serves as a precursor for more advanced attacks, such as remote code execution or credential theft."
}