4.3 Medium

CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure

Description

The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Tutor LMS 1.6	1.6.4 → < 4.2.0	4.2.0

References

wpscan.com wpscan.com

Timeline

Published November 5, 2026
Last modified November 6, 2026

The 18 CVEs of Tutor LMS →

CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its… 7.5 High CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering… 6.5 Medium CVE-2026-85572 The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its… 4.3 Medium CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to… 7.2 High

Track this CVE