Skip to content
OpenAdvisories

Product · Themeum

Tutor LMS – eLearning and online course solution

48 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2026-78175

    Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is du…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2026-3360

    Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_o…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2025-13673 Public exploit

    Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of suffic…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.1
    CVE-2026-1375 Public exploit

    Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2024-10400 Public exploit Scanner template EPSS 83%

    Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

    The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.2
    CVE-2024-4902

    Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.8
    CVE-2024-4318

    Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection

    The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.8
    CVE-2024-1751 Scanner template

    Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS