Tutor LMS Pro

Tutor LMS Pro has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 6 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (44%). Other recurring categories include SQL Injection, Improper Authentication.

Every one of the 9 issues recorded for Tutor LMS Pro has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (3) reported by villu164.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Tutor LMS Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-0953

Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login

Read the full analysis

Vulnerability Records

9 records


2026-03-23 00:00	Tutor LMS Pro <= 3.9.8 - Missing Authorization Tutor LMS Pro <= 3.9.8	`CVE-2026-25406`	5.3 Medium	Phat RiO	Yes
2026-03-09 16:33	Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login Tutor LMS Pro <= 3.9.5	`CVE-2026-0953`	9.8 Critical	Phat RiO	Yes
2026-01-13 00:00	Tutor LMS Pro <= 3.9.6 - Unauthenticated SQL Injection Tutor LMS Pro <= 3.9.6	`CVE-2026-22332`	7.5 High	0xd4rk5id3	Yes
2025-10-24 17:30	Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments Tutor LMS Pro <= 3.8.3	`CVE-2025-6639`	5.4 Medium	sergioframi	Yes
2025-08-12 18:27	Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection Tutor LMS Pro <= 3.7.0	`CVE-2025-6184`	8.8 High	sergioframi	Yes
2024-08-29 00:00	Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference Tutor LMS Pro <= 2.7.2	`CVE-2024-5784`	7.1 High	Thanh Nam Tran	Yes
2024-05-15 00:00	Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation Tutor LMS Pro <= 2.7.0	`CVE-2024-4351`	8.8 High	villu164	Yes
2024-05-15 00:00	Tutor LMS Pro <= 2.7.0 - Missing Authorization Tutor LMS Pro <= 2.7.0	`CVE-2024-4222`	7.3 High	villu164	Yes
2024-05-15 00:00	Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection Tutor LMS Pro <= 2.7.0	`CVE-2024-4352`	8.8 High	villu164	Yes

Showing 1–9 of 9 reports