Information Exposure Vulnerability in Tutor LMS Plugin by WordPress
CVE-2026-85570
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-85570?
The Tutor LMS WordPress plugin, prior to version 4.2.0, exhibits a vulnerability where the correct answers to quiz questions are disclosed to students. This occurs regardless of the user settings that control answer visibility, allowing any enrolled student access to the correct responses before they submit their quiz attempts. This flaw potentially undermines the integrity of the assessment process.
Affected Version(s)
Tutor LMS 1.6.4 < 4.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.