Missing Authorization
29 records37.7%First: 2023. Latest: 2026.
Plugin security history
Tutor LMS – eLearning and online course solution Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 77 vulnerability records associated with Tutor LMS – eLearning and online course solution, published between 2020 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
77Total records
2Critical
16High
58Medium
1Low
0Informational
77Patched records
0Currently marked unpatched
2020-02-04First disclosure
2026-07-27Latest disclosure
73 of 77CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2020 | 1 | |
| 2021 | 14 | |
| 2022 | 2 | |
| 2023 | 8 | |
| 2024 | 21 | |
| 2025 | 4 | |
| 2026 | 27 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 2.6% |
| High | 16 | 20.8% |
| Medium | 58 | 75.3% |
| Low | 1 | 1.3% |
Vulnerability-Type Breakdown
SQL Injection
19 records24.7%First: 2021. Latest: 2026.
Cross-Site Scripting
16 records20.8%First: 2021. Latest: 2026.
CSRF
4 records5.2%First: 2020. Latest: 2024.
Privilege Escalation
3 records3.9%First: 2021. Latest: 2025.
Other
3 records3.9%First: 2021. Latest: 2025.
Path Traversal
1 record1.3%First: 2024. Latest: 2024.
Information Disclosure
1 record1.3%First: 2026. Latest: 2026.
Authentication Bypass
1 record1.3%First: 2026. Latest: 2026.
Patch Status
- Patched
- 77
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
4.0.24.0.13.9.143.9.133.9.123.9.103.9.93.9.83.9.73.9.63.9.53.9.43.9.03.8.03.4.12.7.72.7.52.7.42.7.32.7.22.7.12.7.02.6.22.6.12.3.02.2.12.2.02.1.92.0.102.0.91.9.121.9.111.9.91.9.61.9.21.8.81.8.31.7.71.9.131.5.3
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-1.9.12 | Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting | January 10, 2021 | 1.9.13 | Medium |
[*, 1.5.3) | Tutor LMS < 1.5.3 - Cross-Site Request Forgery | February 4, 2020 | 1.5.3 | High |
Selected source records
Latest Records
MediumCVE-2026-15444
Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
Published: July 27, 2026
- Affected versions
- *-4.0.1
- Patched versions
- 4.0.2
MediumCVE-2026-15022
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
Published: July 15, 2026
- Affected versions
- *-4.0.0
- Patched versions
- 4.0.1
MediumCVE-2026-57694
Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference
Published: July 6, 2026
- Affected versions
- *-3.9.13
- Patched versions
- 3.9.14
MediumCVE-2026-13443
Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
Published: June 30, 2026
- Affected versions
- *-3.9.13
- Patched versions
- 3.9.14
MediumCVE-2026-12275
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure
Published: June 22, 2026
- Affected versions
- *-3.9.12
- Patched versions
- 3.9.13
MediumCVE-2026-12273
Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation
Published: June 22, 2026
- Affected versions
- *-3.9.12
- Patched versions
- 3.9.13
MediumCVE-2026-12271
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
Published: June 22, 2026
- Affected versions
- *-3.9.12
- Patched versions
- 3.9.13
MediumCVE-2026-10736
Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
Published: June 17, 2026
- Affected versions
- *-3.9.11
- Patched versions
- 3.9.12
Highest-Severity Records
CriticalCVE-2023-25700
Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection
Published: May 30, 2023
- Affected versions
- *-2.1.10
- Patched versions
- 2.2.0
CriticalCVE-2024-4223
Tutor LMS <= 2.7.0 - Missing Authorization
Published: May 15, 2024
- Affected versions
- *-2.7.0
- Patched versions
- 2.7.1
HighCVE-2023-25800
Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection
Published: May 30, 2023
- Affected versions
- *-2.2.0
- Patched versions
- 2.2.1
HighCVE-2021-24184
Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation
Published: March 15, 2021
- Affected versions
- [*, 1.7.7)
- Patched versions
- 1.7.7
HighCVE-2023-25990
Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection
Published: May 30, 2023
- Affected versions
- *-2.1.10
- Patched versions
- 2.2.0
HighCVE-2024-4318
Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
Published: May 15, 2024
- Affected versions
- *-2.7.0
- Patched versions
- 2.7.1
HighCVE-2020-8615
Tutor LMS < 1.5.3 - Cross-Site Request Forgery
Published: February 4, 2020
- Affected versions
- [*, 1.5.3)
- Patched versions
- 1.5.3
HighCVE-2021-24182
Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question
Published: March 15, 2021
- Affected versions
- *-1.8.2
- Patched versions
- 1.8.3
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.