Plugin security history

Tutor LMS – eLearning and online course solution Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 77 vulnerability records associated with Tutor LMS – eLearning and online course solution, published between 2020 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

77Total records

2Critical

16High

58Medium

1Low

0Informational

77Patched records

0Currently marked unpatched

2020-02-04First disclosure

2026-07-27Latest disclosure

73 of 77CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2021	14	14 records
2022	2	2 records
2023	8	8 records
2024	21	21 records
2025	4	4 records
2026	27	27 records

Severity Breakdown

Severity	Records	Share
Critical	2	2.6%
High	16	20.8%
Medium	58	75.3%
Low	1	1.3%

Vulnerability-Type Breakdown

Missing Authorization

29 records37.7%

First: 2023. Latest: 2026.

SQL Injection

19 records24.7%

First: 2021. Latest: 2026.

Cross-Site Scripting

16 records20.8%

First: 2021. Latest: 2026.

CSRF

4 records5.2%

First: 2020. Latest: 2024.

Privilege Escalation

3 records3.9%

First: 2021. Latest: 2025.

Other

3 records3.9%

First: 2021. Latest: 2025.

Path Traversal

1 record1.3%

First: 2024. Latest: 2024.

Information Disclosure

1 record1.3%

First: 2026. Latest: 2026.

Authentication Bypass

1 record1.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 77
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.0.2
4.0.1
3.9.14
3.9.13
3.9.12
3.9.10
3.9.9
3.9.8
3.9.7
3.9.6
3.9.5
3.9.4
3.9.0
3.8.0
3.4.1
2.7.7
2.7.5
2.7.4
2.7.3
2.7.2
2.7.1
2.7.0
2.6.2
2.6.1
2.3.0
2.2.1
2.2.0
2.1.9
2.0.10
2.0.9
1.9.12
1.9.11
1.9.9
1.9.6
1.9.2
1.8.8
1.8.3
1.7.7
1.9.13
1.5.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.9.3`	Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details	January 7, 2026	3.9.4	Medium
`*-3.9.4`	Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference	January 2, 2026	3.9.5	Medium
`*-3.8.3`	Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure	October 24, 2025	3.9.0	Medium
`*-3.8.3`	Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update	October 24, 2025	3.9.0	Medium
`*-3.7.4`	Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection	September 9, 2025	3.8.0	Medium
`*-3.4.0`	Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection	April 7, 2025	3.4.1	Medium
`*-2.7.6`	Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration	November 20, 2024	2.7.7	Medium
`*-2.7.6`	Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter	November 20, 2024	2.7.7	High
`*-2.7.4`	Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'	September 9, 2024	2.7.5	Medium
`*-2.7.2`	Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection	August 16, 2024	2.7.3	High
`*-2.7.3`	Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting	August 9, 2024	2.7.4	Medium
`*-2.7.3`	Tutor LMS <= 2.7.3 - Missing Authorization	August 7, 2024	2.7.4	Medium
`*-2.7.2`	Tutor LMS <= 2.7.2 - Cross-Site Request Forgery	August 1, 2024	2.7.3	Medium
`*-2.7.2`	Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting	July 10, 2024	2.7.3	Medium
`*-2.7.1`	Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal	June 27, 2024	2.7.2	Low
`*-2.7.1`	Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection	June 6, 2024	2.7.2	High
`*-2.7.1`	Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion	June 6, 2024	2.7.2	Medium
`*-2.7.0`	Tutor LMS <= 2.7.0 - Missing Authorization	May 15, 2024	2.7.1	Critical
`*-2.7.0`	Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection	May 15, 2024	2.7.1	High
`*-2.7.0`	Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion	May 15, 2024	2.7.1	Medium
`*-2.6.2`	Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update	April 26, 2024	2.7.0	Medium
`*-2.6.2`	Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode	April 24, 2024	2.7.0	Medium
`*-2.6.1`	Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	March 12, 2024	2.6.2	Medium
`*-2.6.1`	Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase	March 12, 2024	2.6.2	Medium
`*-2.6.1`	Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection	March 11, 2024	2.6.2	High

Selected source records

Latest Records

MediumCVE-2026-15444

Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

Published: July 27, 2026

Affected versions: *-4.0.1
Patched versions: 4.0.2

Original Wordfence record

MediumCVE-2026-15022

Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array

Published: July 15, 2026

Affected versions: *-4.0.0
Patched versions: 4.0.1

Original Wordfence record

MediumCVE-2026-57694

Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference

Published: July 6, 2026

Affected versions: *-3.9.13
Patched versions: 3.9.14

Original Wordfence record

MediumCVE-2026-13443

Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

Published: June 30, 2026

Affected versions: *-3.9.13
Patched versions: 3.9.14

Original Wordfence record

MediumCVE-2026-12275

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-12273

Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-12271

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification

Published: June 22, 2026

Affected versions: *-3.9.12
Patched versions: 3.9.13

Original Wordfence record

MediumCVE-2026-10736

Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter

Published: June 17, 2026

Affected versions: *-3.9.11
Patched versions: 3.9.12

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-25700

Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection

Published: May 30, 2023

Affected versions: *-2.1.10
Patched versions: 2.2.0

Original Wordfence record

CriticalCVE-2024-4223

Tutor LMS <= 2.7.0 - Missing Authorization

Published: May 15, 2024

Affected versions: *-2.7.0
Patched versions: 2.7.1

Original Wordfence record

HighCVE-2023-25800

Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection

Published: May 30, 2023

Affected versions: *-2.2.0
Patched versions: 2.2.1

Original Wordfence record

HighCVE-2021-24184

Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation

Published: March 15, 2021

Affected versions: [*, 1.7.7)
Patched versions: 1.7.7

Original Wordfence record

HighCVE-2023-25990

Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection

Published: May 30, 2023

Affected versions: *-2.1.10
Patched versions: 2.2.0

Original Wordfence record

HighCVE-2024-4318

Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection

Published: May 15, 2024

Affected versions: *-2.7.0
Patched versions: 2.7.1

Original Wordfence record

HighCVE-2020-8615

Tutor LMS < 1.5.3 - Cross-Site Request Forgery

Published: February 4, 2020

Affected versions: [*, 1.5.3)
Patched versions: 1.5.3

Original Wordfence record

HighCVE-2021-24182

Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question

Published: March 15, 2021

Affected versions: *-1.8.2
Patched versions: 1.8.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory