External risk intelligence

Tutor LMS WordPress Plugin Arbitrary PHP Function Invocation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19092

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and this plugin functionality is designed to be accessible to site visitors, making the attack surface frequently exposed to the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin that could allow unauthorized access to sensitive functions and data. This issue stems from how the plugin handles user requests when displaying information, potentially enabling attackers to execute commands and retrieve outputs without needing any credentials. The main concern is confirming if this specific plugin is in use and, if so, understanding the potential exposure.

Plugin flaw allows unauthorized PHP function calls.
Confirms use and exposure of the specific plugin.
Assess relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this flaw by sending a crafted request to a vulnerable WordPress site using the Tutor LMS plugin. This request could overwrite internal variables during template rendering, allowing the attacker to trigger arbitrary PHP functions without authentication and obtain their output.

No authentication needed.
Manipulate request data to overwrite variables.
Arbitrary code execution and data exfiltration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to execute arbitrary PHP functions on the server and access their output. This could happen when the plugin renders templates, potentially exposing sensitive system or user data.

Server-side code execution.
Unauthenticated arbitrary function invocation.
Sensitive data exposure or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, application owners and infrastructure teams should collaborate to identify all instances of the affected WordPress plugin. The first practical step involves locating where the plugin is deployed, assessing its exposure and business criticality, and then engaging the accountable owner to plan remediation efforts based on the identified risks.

Application owners should prioritize remediation.
Verify plugin instances and public accessibility.
Coordinate with the vendor and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tutor LMS WordPress plugin?

Tutor LMS is a specialized plugin for WordPress designed to help site administrators create, manage, and deliver online learning courses. It provides the framework for hosting lessons, quizzes, and student management directly within the WordPress dashboard. Because it handles educational content and user interaction, it is a core functional component for websites operating as learning management systems.

How does CVE-2026-19092 allow unauthorized function calls?

This vulnerability involves a flaw where the plugin fails to sanitize user-provided request data. An attacker can manipulate this data to overwrite internal variables used while the plugin renders templates. This improper input handling tricks the system into executing arbitrary PHP functions that take no arguments, effectively letting an unauthorized user invoke backend processes and view the resulting output.

Do I need to be logged in to trigger this vulnerability?

No, authentication is not required to trigger this flaw. The vulnerability is accessible to unauthenticated users who send specifically crafted requests to the WordPress site. It is important to note that this issue is tied to the template rendering process; requests that do not interact with these vulnerable rendering paths will not trigger the bug.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because Tutor LMS is a plugin for WordPress, a platform typically deployed as a public-facing web application. Since the plugin's features are designed to be accessible to site visitors, the vulnerable code is frequently exposed directly to the public internet, making it reachable for remote attackers without needing internal access.

What is the first step to address CVE-2026-19092?

The immediate priority is to identify every instance of the Tutor LMS plugin running across your infrastructure. Once you have located where the plugin is deployed, assess whether those specific sites are internet-facing and determine the business criticality of those assets. After identifying your footprint, coordinate with the site owners to plan for the necessary updates or mitigation.

References

wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.