WordPress Plugin Vulnerabilities

Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure

Description

The plugin does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.

Proof of Concept

Affects Plugins

Plugin icon
tutor
Fixed in 4.2.0

References

CVE
CVE-2026-85570

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
797ac2aa-50f8-4abd-8ec0-96254b1fe13c

Timeline

Publicly Published
2026-11-02 (about 3 days ago)
Added
2026-11-02 (about 2 days ago)
Last Updated
2026-11-02 (about 2 days ago)

Other

Published
Title
Published
2026-07-23
Title
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
Published
2026-01-12
Title
EventPrime - Events Calendar, Bookings and Tickets < 4.2.8.0 - Unauthenticated Sensitive Information Exposure via REST API
Published
2026-09-09
Title
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
Published
2023-12-29
Title
Everest Backup < 2.2.0 - Sensitive Information Exposure via Log File
Published
2025-03-04
Title
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More < 2.6.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure