{"id":"CVE-2026-85570","kind":"vulnerability","aliases":["CVE-2026-85570"],"related":[],"title":"Tutor LMS WordPress plugin leaks quiz answers to enrolled students","description":"The Tutor LMS  WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.","summary":"The Tutor LMS WordPress plugin before 4.2.0 includes correct quiz answers in the page served to students taking a quiz, even when the setting meant to hide answers is on. Any enrolled student can read the answers before submitting an attempt.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","package","tutor-lms","wordpress"],"not_affected_if":["no-quizzes","plugin-4.2.0-or-newer"],"how_to_check":"- Check the installed Tutor LMS version in the WordPress plugins screen or the plugin's main file header\n- Confirm whether students can take quizzes on your site (unknown if the sources do not say more)","fix":"- Tutor LMS: move to `4.2.0` or later (per the sources' description: fixed in versions before 4.2.0 are affected)","status":"open","published_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:06+00:00","updated_at":"2026-11-05T06:33:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- Tutor LMS: move to `4.2.0` or later (per the sources' description: fixed in versions before 4.2.0 are affected)","reach":"internet","title":"Tutor LMS WordPress plugin leaks quiz answers to enrolled students","impact":"low","summary":"The Tutor LMS WordPress plugin before 4.2.0 includes correct quiz answers in the page served to students taking a quiz, even when the setting meant to hide answers is on. Any enrolled student can read the answers before submitting an attempt.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","tutor-lms","lms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"enrolled students read quiz answers before submitting attempts","analyst_note":"Sources give only the NVD description; confirm the fixed version, any vendor advisory and whether the answer-hiding setting matters for exposure.","how_to_check":"- Check the installed Tutor LMS version in the WordPress plugins screen or the plugin's main file header\n- Confirm whether students can take quizzes on your site (unknown if the sources do not say more)","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-4.2.0-or-newer","no-quizzes"],"who_is_affected":"Sites running the Tutor LMS WordPress plugin older than 4.2.0 where students take graded or quiz content. Exposure depends on students being enrolled, so sites without public or student quiz access are less exposed. Sites on newer versions are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4227,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85570':13A,16A '4.2.0':29B,70C 'allow':108C 'answer':7A,33B,50B,59B,76C,105C 'attempt':63B,118C 'control':103C 'correct':31B,75C 'cve':11A,14A 'enrol':9A,54B,110C 'even':43B 'hide':49B 'includ':30B,82C 'intend':101C 'leak':5A 'lms':2A,17B,21B,25B,66C 'meant':47B 'obtain':113C 'packag':18B 'page':36B,85C 'plugin':4A,27B,68C 'prevent':73C 'question':79C 'quiz':6A,32B,42B,78C,93C 'read':57B 'regardless':97C 'reveal':107C 'serv':37B,87C 'set':46B,100C 'student':10A,39B,55B,90C,111C 'submit':61B,116C 'take':40B,91C 'tutor':1A,20B,24B,65C 'tutor-lm':19B 'whether':104C 'wordpress':3A,22B,26B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Tutor LMS WordPress plugin older than 4.2.0 where students take graded or quiz content. Exposure depends on students being enrolled, so sites without public or student quiz access are less exposed. Sites on newer versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["lms","medium","package","tutorlms","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85570","severity":null,"published_at":"2026-11-05T06:17:08+00:00","modified_at":"2026-11-05T06:17:08+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}