CVE-2026-85570 · Package
NO FIX YET · SEE WHAT TO DO
The Tutor LMS WordPress plugin before 4.2.0 includes correct quiz answers in the page served to students taking a quiz, even when the setting meant to hide answers is on. Any enrolled student can read the answers before submitting an attempt.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Tutor LMS WordPress plugin older than 4.2.0 where students take graded or quiz content. Exposure depends on students being enrolled, so sites without public or student quiz access are less exposed. Sites on newer versions are not affected.
Not affected if no-quizzes, plugin-4.2.0-or-newer
Who cares lms, tutor-lms, wordpress
4.2.0 or later (per the sources' description: fixed in versions before 4.2.0 are affected)The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.