Plugin security history

Tutor LMS – eLearning and online course solution Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 77 vulnerability records associated with Tutor LMS – eLearning and online course solution, published between 2020 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

77Total records

2Critical

16High

58Medium

1Low

0Informational

77Patched records

0Currently marked unpatched

2020-02-04First disclosure

2026-07-27Latest disclosure

73 of 77CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2021	14	14 records
2022	2	2 records
2023	8	8 records
2024	21	21 records
2025	4	4 records
2026	27	27 records

Severity Breakdown

Severity	Records	Share
Critical	2	2.6%
High	16	20.8%
Medium	58	75.3%
Low	1	1.3%

Vulnerability-Type Breakdown

Missing Authorization

29 records37.7%

First: 2023. Latest: 2026.

SQL Injection

19 records24.7%

First: 2021. Latest: 2026.

Cross-Site Scripting

16 records20.8%

First: 2021. Latest: 2026.

CSRF

4 records5.2%

First: 2020. Latest: 2024.

Privilege Escalation

3 records3.9%

First: 2021. Latest: 2025.

Other

3 records3.9%

First: 2021. Latest: 2025.

Path Traversal

1 record1.3%

First: 2024. Latest: 2024.

Information Disclosure

1 record1.3%

First: 2026. Latest: 2026.

Authentication Bypass

1 record1.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 77
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.0.2
4.0.1
3.9.14
3.9.13
3.9.12
3.9.10
3.9.9
3.9.8
3.9.7
3.9.6
3.9.5
3.9.4
3.9.0
3.8.0
3.4.1
2.7.7
2.7.5
2.7.4
2.7.3
2.7.2
2.7.1
2.7.0
2.6.2
2.6.1
2.3.0
2.2.1
2.2.0
2.1.9
2.0.10
2.0.9
1.9.12
1.9.11
1.9.9
1.9.6
1.9.2
1.8.8
1.8.3
1.7.7
1.9.13
1.5.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.0.1`	Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter	July 27, 2026	4.0.2	Medium
`*-4.0.0`	Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array	July 15, 2026	4.0.1	Medium
`*-3.9.13`	Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference	July 6, 2026	3.9.14	Medium
`*-3.9.13`	Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title	June 30, 2026	3.9.14	Medium
`*-3.9.12`	Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification	June 22, 2026	3.9.13	Medium
`*-3.9.12`	Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation	June 22, 2026	3.9.13	Medium
`*-3.9.12`	Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure	June 22, 2026	3.9.13	Medium
`*-3.9.11`	Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter	June 17, 2026	3.9.12	Medium
`*-3.9.9`	Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter	May 12, 2026	3.9.10	Medium
`*-3.9.7`	Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization	April 20, 2026	3.9.8	Medium
`*-3.9.8`	Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter	April 16, 2026	3.9.9	Medium
`*-3.9.8`	Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order	April 16, 2026	3.9.9	Medium
`*-3.9.7`	Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification	April 10, 2026	3.9.8	Medium
`*-3.9.7`	Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment	April 10, 2026	3.9.8	Medium
`*-3.9.7`	Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter	April 9, 2026	3.9.8	High
`*-3.9.4`	Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference	March 16, 2026	3.9.5	Medium
`*-3.9.7`	Tutor LMS <= 3.9.7 - Missing Authorization	March 15, 2026	3.9.8	Medium
`*-3.9.6`	Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code	February 27, 2026	3.9.7	High
`*-3.9.5`	Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization	February 25, 2026	3.9.6	Medium
`*-3.9.5`	Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action	February 2, 2026	3.9.6	Medium
`*-3.9.5`	Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion	February 2, 2026	3.9.6	High
`*-3.9.4`	Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion	January 20, 2026	3.9.5	Medium
`*-3.9.3`	Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification	January 8, 2026	3.9.4	Medium
`*-3.9.2`	Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion	January 8, 2026	3.9.4	Medium
`*-3.9.3`	Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass	January 8, 2026	3.9.4	Medium

Selected source records

Latest Records

MediumCVE-2026-15444

Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

Published: July 27, 2026

Affected versions: *-4.0.1
Patched versions: 4.0.2

Original Wordfence record

MediumCVE-2026-15022

Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array

Published: July 15, 2026

Affected versions: *-4.0.0
Patched versions: 4.0.1

Original Wordfence record

MediumCVE-2026-57694

Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference

Published: July 6, 2026

Affected versions: *-3.9.13
Patched versions: 3.9.14

Original Wordfence record

MediumCVE-2026-13443

Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

Published: June 30, 2026

Affected versions: *-3.9.13
Patched versions: 3.9.14

Original Wordfence record

MediumCVE-2026-12275

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-12273

Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-12271

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-10736

Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter

Published: June 17, 2026

Affected versions: *-3.9.11
Patched versions: 3.9.12

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-25700

Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection

Published: May 30, 2023

Affected versions: *-2.1.10
Patched versions: 2.2.0

Original Wordfence record

CriticalCVE-2024-4223

Tutor LMS <= 2.7.0 - Missing Authorization

Published: May 15, 2024

Affected versions: *-2.7.0
Patched versions: 2.7.1

Original Wordfence record

HighCVE-2023-25800

Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection

Published: May 30, 2023

Affected versions: *-2.2.0
Patched versions: 2.2.1

Original Wordfence record

HighCVE-2021-24184

Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation

Published: March 15, 2021

Affected versions: [*, 1.7.7)
Patched versions: 1.7.7

Original Wordfence record

HighCVE-2023-25990

Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection

Published: May 30, 2023

Affected versions: *-2.1.10
Patched versions: 2.2.0

Original Wordfence record

HighCVE-2024-4318

Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection

Published: May 15, 2024

Affected versions: *-2.7.0
Patched versions: 2.7.1

Original Wordfence record

HighCVE-2020-8615

Tutor LMS < 1.5.3 - Cross-Site Request Forgery

Published: February 4, 2020

Affected versions: [*, 1.5.3)
Patched versions: 1.5.3

Original Wordfence record

HighCVE-2021-24182

Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question

Published: March 15, 2021

Affected versions: *-1.8.2
Patched versions: 1.8.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory