Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

Description

The plugin does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

The reachable functions include ones that destroy every user session on the site, delete core WordPress options and drop database tables, so the impact covers disclosure, integrity and availability. This is not remote code execution: the attacker supplies the name of a callable that already exists and cannot pass arguments to it.