Tutor LMS WordPress Plugin PHP Injection Flaw

The Tutor LMS WordPress plugin, before version 4.0.6, has a vulnerability that allows unauthenticated users to execute arbitrary zero-argument PHP functions by manipulating request data during template rendering.

This is due to the plugin not properly sanitizing user input, which can lead to PHP code injection.