The vulnerability resides in the Tutor LMS WordPress plugin versions earlier than 4.0.6, where internal template variables can be overwritten by request data. This oversight allows an unauthenticated user to supply data that shadows a PHP variable and triggers the execution of any zero‑argument PHP function, such as system(), var_dump(), or others. The attack grants the attacker control over function calls without any authentication, enabling direct code execution or information disclosure. The weakness is a form of insecure function invocation rooted in improper input validation and access controls.

Any WordPress site running the Tutor LMS plugin before version 4.0.6 is affected. The vendor is listed as 'Tutor LMS' in the CNA record. No specific patch release dates are supplied in the CNA data beyond the requirement to upgrade to 4.0.6 or newer. Version and product information is otherwise missing, so administrators should verify the plugin version on their sites.

The CVSS score of 9.8 marks the flaw as critical, indicating that exploitation leads to full application compromise. The EPSS score is 1%, indicating a very low but nonzero likelihood of exploitation, while the lack of a KEV listing does not reduce the potential impact. The likely attack vector is a web request to the plugin’s template rendering endpoint; the vulnerability is exploitable by any unauthenticated user, making it trivial to attack once the request paths are known. Attackers could remotely execute arbitrary PHP code by sending specially crafted parameters, thereby taking over the hosting environment or exfiltrating data.