Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-19092
Unknown Tutor LMS — Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H H 9.8 .0200 80.0 —
AFFECTED
Product Versions Fixed
Tutor LMS 2.1.3 – —
TIMELINE
Aug 6 Reserved by WPScan
Aug 27 Published (CNA: WPScan)
Aug 28 EXPLOIT PUBLISHED — CVE-2026-19092 (Unknown Tutor LMS). Public exploit reference added.
Description
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 6, 2026 | Reserved | Reserved by WPScan |
| August 27, 2026 | Published | Published (CNA: WPScan) |
| August 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-19092 (Unknown Tutor LMS). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Unknown | Tutor LMS | — | 2.1.3 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19092 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
