https://cvebrief.com/archive/cves/vendor/themeum/ High and critical Themeum vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Sat, 12 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-78175/ cvebrief-themeum-CVE-2026-78175 Sat, 12 Sep 2026 12:00:00 GMT The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-19092/ cvebrief-themeum-CVE-2026-19092 Fri, 28 Aug 2026 12:00:00 GMT The Tutor LMS WordPress plugin before 4.0.6 is vulnerable to an injection flaw allowing unauthenticated users to execute arbitrary zero-argument PHP functions and capture the resulting output. Fix documented: 4.0.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-12275/ cvebrief-themeum-CVE-2026-12275 Thu, 16 Jul 2026 12:00:00 GMT The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enro Fix documented: 3.9.13 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57724/ cvebrief-themeum-CVE-2026-57724 Tue, 14 Jul 2026 12:00:00 GMT A deserialization of untrusted data vulnerability in the Themeum Kirki WordPress plugin allows for PHP object injection. Fix documented: 6.0.13 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57726/ cvebrief-themeum-CVE-2026-57726 Tue, 14 Jul 2026 12:00:00 GMT Themeum Kirki is susceptible to a Blind SQL Injection vulnerability, allowing unauthenticated attackers to manipulate SQL queries. Fix documented: 6.0.13 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-57727/ cvebrief-themeum-CVE-2026-57727 Tue, 14 Jul 2026 12:00:00 GMT Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels Fix documented: 6.2.1 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-8206/ cvebrief-themeum-CVE-2026-8206 Tue, 02 Jun 2026 12:00:00 GMT The Kirki plugin for WordPress is vulnerable to unauthenticated privilege escalation via an account takeover flaw in the password reset process. Fix documented: 6.0.7 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-8073/ cvebrief-themeum-CVE-2026-8073 Wed, 20 May 2026 12:00:00 GMT The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6 Fix documented: 6.0.7 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-3360/ cvebrief-themeum-CVE-2026-3360 Sat, 11 Apr 2026 12:00:00 GMT The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3 Fix documented: 3.9.8 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-25406/ cvebrief-themeum-CVE-2026-25406 Fri, 27 Mar 2026 12:00:00 GMT Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse Fix documented: 3.9.9 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-0953/ cvebrief-themeum-CVE-2026-0953 Wed, 11 Mar 2026 12:00:00 GMT An authentication bypass in the Tutor LMS Pro plugin for WordPress allows unauthenticated attackers to log in as any user, including administrators, via the Social Login addon. Fix documented: 3.9.6 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-13673/ cvebrief-themeum-CVE-2025-13673 Sat, 28 Feb 2026 12:00:00 GMT The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3 Fix documented: 3.9.7 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-1375/ cvebrief-themeum-CVE-2026-1375 Tue, 03 Feb 2026 12:00:00 GMT The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3 Fix documented: 3.9.6 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-58993/ cvebrief-themeum-CVE-2025-58993 Tue, 09 Sep 2025 12:00:00 GMT Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection Fix documented: 3.8.0 (Wordfence). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-6184/ cvebrief-themeum-CVE-2025-6184 Wed, 13 Aug 2025 12:00:00 GMT The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3 Fix documented: 3.7.1 (Wordfence). Independent analyst report on CVE Brief.