From 443961fe6f24abbfe43602b5570c2a62c94e1c5d Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:23:50 +0600
Subject: [PATCH 1/7] Security: XSS security issue on the registration form by
 old pass reflect value

---
 templates/dashboard/instructor/registration.php | 2 +-
 templates/dashboard/registration.php            | 2 +-
 views/pages/add_new_instructor.php              | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/templates/dashboard/instructor/registration.php b/templates/dashboard/instructor/registration.php
index b78ce96303..b76a32b6e9 100644
--- a/templates/dashboard/instructor/registration.php
+++ b/templates/dashboard/instructor/registration.php
@@ -76,7 +76,7 @@
 				<input class="tutor-form-control tutor-input" type="text" name="email" value="<?php echo esc_attr( tutor_utils()->input_old( 'email' ) ); ?>" placeholder="<?php esc_html_e( 'E-Mail', 'tutor' ); ?>" required autocomplete="email">
 			</div>
 
-			<div class="tutor-password-strength-checker tutor-mb-8" x-data="{ show: false, value: '<?php echo esc_attr( tutor_utils()->input_old( 'password' ) ); ?>' }">
+			<div class="tutor-password-strength-checker tutor-mb-8" x-data="{ show: false, value: '' }">
 				<div class="tutor-input-field">
 					<label class="tutor-block tutor-mb-3"><?php esc_html_e( 'Password', 'tutor' ); ?></label>
 					<div class="tutor-form-wrap" style="position: relative;">
diff --git a/templates/dashboard/registration.php b/templates/dashboard/registration.php
index 9a831b3ca4..3da4c70f05 100644
--- a/templates/dashboard/registration.php
+++ b/templates/dashboard/registration.php
@@ -85,7 +85,7 @@
 				</div>
 			</div>
 
-			<div class="tutor-password-strength-checker" x-data="{ show: false, value: '<?php echo esc_attr( tutor_utils()->input_old( 'password' ) ); ?>' }">
+			<div class="tutor-password-strength-checker" x-data="{ show: false, value: '' }">
 				<div class="tutor-password-field">
 					<label class="tutor-block tutor-mb-3"><?php esc_html_e( 'Password', 'tutor' ); ?></label>
 					<div class="tutor-input-field tutor-mb-8" style="position: relative;">
diff --git a/views/pages/add_new_instructor.php b/views/pages/add_new_instructor.php
index f0f68aa707..574a660103 100644
--- a/views/pages/add_new_instructor.php
+++ b/views/pages/add_new_instructor.php
@@ -110,7 +110,7 @@
 			</div>
 
 			<div class="tutor-option-field">
-				<input type="password" name="password" value="<?php echo esc_attr( tutor_utils()->input_old( 'password' ) ); ?>" placeholder="<?php esc_attr_e( 'Password', 'tutor' ); ?>">
+				<input type="password" name="password" value="" placeholder="<?php esc_attr_e( 'Password', 'tutor' ); ?>">
 			</div>
 		</div>
 
@@ -123,7 +123,7 @@
 			</div>
 
 			<div class="tutor-option-field">
-				<input type="password" name="password_confirmation" value="<?php echo esc_attr( tutor_utils()->input_old( 'password_confirmation' ) ); ?>" placeholder="<?php esc_attr_e( 'Password Confirmation', 'tutor' ); ?>">
+				<input type="password" name="password_confirmation" value="" placeholder="<?php esc_attr_e( 'Password Confirmation', 'tutor' ); ?>">
 			</div>
 		</div>
 

From e31586a6ae1db8db370c5cd3d82e153facaa1576 Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:15:22 +0600
Subject: [PATCH 2/7] Fix: XSS issue on the SearchFilter component

---
 components/SearchFilter.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/components/SearchFilter.php b/components/SearchFilter.php
index b8c660a2f4..dd68dc53e7 100644
--- a/components/SearchFilter.php
+++ b/components/SearchFilter.php
@@ -240,7 +240,7 @@ public function get(): string {
 
 		$clear_action = 'GET' === strtoupper( $method )
 			? 'window.location.href = ' . wp_json_encode( $clear_url )
-			: "setValue('" . esc_js( $input_name ) . "', ''); \$el.closest('form').submit();";
+			: 'setValue(' . wp_json_encode( (string) $input_name ) . ', \'\'); $el.closest(\'form\').submit();';
 
 		$this->attributes = array_merge(
 			array(
@@ -279,8 +279,8 @@ public function get(): string {
 						name="<?php echo esc_attr( $input_name ); ?>"
 						placeholder="<?php echo esc_attr( $placeholder ); ?>"
 						class="tutor-input <?php echo esc_attr( $size ); ?> tutor-input-content-left tutor-input-content-clear"
-						x-bind="register('<?php echo esc_attr( $input_name ); ?>')"
-						x-init="$nextTick(() => setValue('<?php echo esc_attr( $input_name ); ?>', '<?php echo esc_attr( $search_value ); ?>'))"
+						x-bind="register(<?php echo esc_attr( wp_json_encode( (string) $input_name ) ); ?>)"
+						x-init="$nextTick(() => setValue(<?php echo esc_attr( wp_json_encode( (string) $input_name ) ); ?>, <?php echo esc_attr( wp_json_encode( (string) $search_value ) ); ?>))"
 					/>
 
 					<button 

From 1da79c0378b3b5528537c0e58fdd56325e39d309 Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:08:20 +0600
Subject: [PATCH 3/7] Security: Fix security issue on the withdraw method field


From 505877cff4bc73bd5a1dc9b59e1584f83fd831bd Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Wed, 26 Aug 2026 12:12:13 +0600
Subject: [PATCH 4/7] Doc comment updated

---
 classes/Withdraw.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/classes/Withdraw.php b/classes/Withdraw.php
index e05ecb01ff..3c3cfe7910 100644
--- a/classes/Withdraw.php
+++ b/classes/Withdraw.php
@@ -187,6 +187,7 @@ public function withdraw_methods_available() {
 	 * Save Withdraw Method Data
 	 *
 	 * @since 1.2.0
+	 * @since 4.0.8 Withdraw method check added
 	 *
 	 * @return void send wp_json response
 	 */

From 642c8f5c8b661139c083b9ad1672641c9ac2a99b Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Wed, 26 Aug 2026 12:37:41 +0600
Subject: [PATCH 5/7] Fix: Security issue on the withdrawal field

---
 classes/RestAPI.php                           | 42 ++++++++----
 classes/Withdraw.php                          | 65 ++++++++++++++-----
 classes/Withdraw_Requests_List.php            |  8 ++-
 models/WithdrawModel.php                      | 64 ++++++++++++++++--
 .../dashboard/account/settings/withdraw.php   |  3 +-
 templates/dashboard/account/withdrawals.php   |  2 +-
 views/pages/withdraw_requests.php             |  2 +-
 7 files changed, 150 insertions(+), 36 deletions(-)

diff --git a/classes/RestAPI.php b/classes/RestAPI.php
index 0842f78754..e2f818c58a 100644
--- a/classes/RestAPI.php
+++ b/classes/RestAPI.php
@@ -181,6 +181,10 @@ public function check_permission( $response, $handler, $request ) {
 	/**
 	 * Class loading
 	 *
+	 * Only autoloads Tutor REST API classes from the plugin's restapi/
+	 * directory. Arbitrary class names must never resolve to files under
+	 * the plugin root (e.g. Composer packages used as POP gadgets).
+	 *
 	 * @since 1.5.0
 	 *
 	 * @param string $class_name class name to load.
@@ -188,20 +192,36 @@ public function check_permission( $response, $handler, $request ) {
 	 * @return void
 	 */
 	private function loader( $class_name ) {
-		if ( ! class_exists( $class_name ) ) {
-			$class_name = preg_replace(
-				array( '/([a-z])([A-Z])/', '/\\\/' ),
-				array( '$1$2', DIRECTORY_SEPARATOR ),
-				$class_name
-			);
+		if ( class_exists( $class_name ) ) {
+			return;
+		}
 
-			$class_name = str_replace( 'TUTOR' . DIRECTORY_SEPARATOR, 'restapi' . DIRECTORY_SEPARATOR, $class_name );
-			$file_name  = $this->path . $class_name . '.php';
+		// Only handle namespaced Tutor REST classes.
+		if ( 0 !== strpos( $class_name, 'TUTOR\\' ) ) {
+			return;
+		}
+
+		$relative = substr( $class_name, strlen( 'TUTOR\\' ) );
+		$relative = str_replace( '\\', DIRECTORY_SEPARATOR, $relative );
 
-			if ( file_exists( $file_name ) ) {
-				require_once $file_name;
-			}
+		// Block path traversal and unexpected nested paths.
+		if ( '' === $relative || false !== strpos( $relative, '..' ) || false !== strpos( $relative, DIRECTORY_SEPARATOR ) ) {
+			return;
 		}
+
+		$restapi_dir = realpath( $this->path . 'restapi' );
+		if ( false === $restapi_dir ) {
+			return;
+		}
+
+		$file_name = $restapi_dir . DIRECTORY_SEPARATOR . $relative . '.php';
+		$real_file = realpath( $file_name );
+
+		if ( false === $real_file || 0 !== strpos( $real_file, $restapi_dir . DIRECTORY_SEPARATOR ) ) {
+			return;
+		}
+
+		require_once $real_file;
 	}
 
 	/**
diff --git a/classes/Withdraw.php b/classes/Withdraw.php
index 2cb3a1461a..a294a69b02 100644
--- a/classes/Withdraw.php
+++ b/classes/Withdraw.php
@@ -187,7 +187,7 @@ public function withdraw_methods_available() {
 	 * Save Withdraw Method Data
 	 *
 	 * @since 1.2.0
-	 * @since 4.0.8 Withdraw method check added
+	 * @since 4.0.8 Harden against object injection: capability check, field whitelist, no esc_sql().
 	 *
 	 * @return void send wp_json response
 	 */
@@ -195,31 +195,64 @@ public function tutor_save_withdraw_account() {
 		// Checking nonce.
 		tutor_utils()->checking_nonce();
 
-		//phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce already verified
 		$user_id = get_current_user_id();
-		$method  = sanitize_text_field( tutor_utils()->avalue_dot( 'tutor_selected_withdraw_method', $_POST ) );
-		if ( ! $method ) {
+
+		// Withdraw account settings are for instructors only.
+		if ( ! tutor_utils()->is_instructor( $user_id ) ) {
+			wp_send_json_error( array( 'msg' => tutor_utils()->error_message() ) );
+		}
+
+		//phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce already verified
+		$method                    = sanitize_key( tutor_utils()->avalue_dot( 'tutor_selected_withdraw_method', $_POST ) );
+		$available_withdraw_method = $this->withdraw_methods_available();
+
+		if ( ! $method || ! isset( $available_withdraw_method[ $method ] ) ) {
 			wp_send_json_error();
 		}
 
-		$method_data               = tutor_utils()->avalue_dot( 'withdraw_method_field.' . $method, $_POST );
-		$available_withdraw_method = $this->withdraw_methods_all();
+		$form_fields = $available_withdraw_method[ $method ]['form_fields'] ?? array();
+		if ( ! is_array( $form_fields ) || empty( $form_fields ) ) {
+			wp_send_json_error();
+		}
 
-		if ( tutor_utils()->count( $method_data ) ) {
-			$saved_data                         = array();
-			$saved_data['withdraw_method_key']  = $method;
-			$saved_data['withdraw_method_name'] = tutor_utils()->avalue_dot( $method . '.method_name', $available_withdraw_method );
+		$method_data = tutor_utils()->avalue_dot( 'withdraw_method_field.' . $method, $_POST );
+		if ( ! is_array( $method_data ) || ! tutor_utils()->count( $method_data ) ) {
+			wp_send_json_error();
+		}
+
+		$saved_data                         = array();
+		$saved_data['withdraw_method_key']  = $method;
+		$saved_data['withdraw_method_name'] = $available_withdraw_method[ $method ]['method_name'] ?? '';
 
-			foreach ( $method_data as $input_name => $value ) {
-				$saved_data[ $input_name ]['value'] = esc_sql( sanitize_text_field( $value ) );
-				$saved_data[ $input_name ]['label'] = tutor_utils()->avalue_dot( $method . ".form_fields.{$input_name}.label", $available_withdraw_method );
+		foreach ( $form_fields as $input_name => $field ) {
+			if ( ! array_key_exists( $input_name, $method_data ) ) {
+				continue;
 			}
 
-			update_user_meta( $user_id, '_tutor_withdraw_method_data', $saved_data );
-			update_user_meta( $user_id, '_tutor_withdraw_selected_method', $method );
-			update_user_meta( $user_id, '_tutor_withdraw_method_data_' . $method, $saved_data );
+			$raw_value = $method_data[ $input_name ];
+			if ( is_array( $raw_value ) ) {
+				continue;
+			}
+
+			$field_type = $field['type'] ?? 'text';
+			$value      = 'email' === $field_type
+				? sanitize_email( wp_unslash( $raw_value ) )
+				: sanitize_text_field( wp_unslash( $raw_value ) );
+
+			$saved_data[ $input_name ] = array(
+				'value' => $value,
+				'label' => $field['label'] ?? '',
+			);
 		}
 
+		if ( count( $saved_data ) <= 2 ) {
+			wp_send_json_error();
+		}
+
+		update_user_meta( $user_id, '_tutor_withdraw_method_data', $saved_data );
+		update_user_meta( $user_id, '_tutor_withdraw_selected_method', $method );
+		update_user_meta( $user_id, '_tutor_withdraw_method_data_' . $method, $saved_data );
+
 		$msg = apply_filters( 'tutor_withdraw_method_set_success_msg', __( 'Withdrawal information saved!', 'tutor' ) );
 		wp_send_json_success( array( 'msg' => $msg ) );
 	}
diff --git a/classes/Withdraw_Requests_List.php b/classes/Withdraw_Requests_List.php
index 3f345d0006..5ceb7a0023 100644
--- a/classes/Withdraw_Requests_List.php
+++ b/classes/Withdraw_Requests_List.php
@@ -10,6 +10,8 @@
 
 namespace TUTOR;
 
+use Tutor\Models\WithdrawModel;
+
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
@@ -203,7 +205,11 @@ public static function update( string $status, int $withdraw_id, $reject_type =
 		if ( 'rejected' === $status ) {
 			$withdraw = self::get_withdraw_by_id( $withdraw_id );
 			if ( $withdraw ) {
-				$details = unserialize( $withdraw->method_data );
+				$details = WithdrawModel::safe_unserialize_array( $withdraw->method_data );
+
+				if ( empty( $details ) ) {
+					$details = array();
+				}
 
 				$details['rejects']  = array(
 					'reject_type'    => sanitize_text_field( $reject_type ),
diff --git a/models/WithdrawModel.php b/models/WithdrawModel.php
index 1d9e53bff8..57e72eaadb 100644
--- a/models/WithdrawModel.php
+++ b/models/WithdrawModel.php
@@ -298,12 +298,68 @@ public static function get_withdrawals_history( $user_id = 0, $filter = array(),
 	 */
 	public static function get_user_withdraw_method( $user_id = 0 ) {
 		$user_id = tutor_utils()->get_user_id( $user_id );
-		$account = get_user_meta( $user_id, '_tutor_withdraw_method_data', true );
+		$account = self::get_user_withdraw_method_meta( $user_id, '_tutor_withdraw_method_data' );
 
-		if ( $account ) {
-			return maybe_unserialize( $account );
+		return $account ? $account : false;
+	}
+
+	/**
+	 * Get a withdraw method meta blob as a plain array.
+	 *
+	 * Reads the raw usermeta value and unserializes with objects disabled so
+	 * poisoned serialized payloads cannot materialize PHP objects.
+	 *
+	 * @since 4.0.8
+	 *
+	 * @param int    $user_id  User ID.
+	 * @param string $meta_key Meta key.
+	 * @return array
+	 */
+	public static function get_user_withdraw_method_meta( $user_id, $meta_key ) {
+		global $wpdb;
+
+		$user_id  = absint( $user_id );
+		$meta_key = sanitize_key( $meta_key );
+
+		if ( ! $user_id || ! $meta_key ) {
+			return array();
 		}
 
-		return false;
+		$raw = $wpdb->get_var(
+			$wpdb->prepare(
+				"SELECT meta_value FROM {$wpdb->usermeta} WHERE user_id = %d AND meta_key = %s LIMIT 1",
+				$user_id,
+				$meta_key
+			)
+		);
+
+		return self::safe_unserialize_array( $raw );
+	}
+
+	/**
+	 * Unserialize withdraw method data as an array only.
+	 *
+	 * @since 4.0.8
+	 *
+	 * @param mixed $data Serialized string or already-decoded array.
+	 * @return array
+	 */
+	public static function safe_unserialize_array( $data ) {
+		if ( is_array( $data ) ) {
+			return $data;
+		}
+
+		if ( ! is_string( $data ) || '' === $data ) {
+			return array();
+		}
+
+		// Reject object payloads before calling unserialize().
+		if ( preg_match( '/(^|;|{|})O:\+?[0-9]+:"/', $data ) ) {
+			return array();
+		}
+
+		$unserialized = unserialize( $data, array( 'allowed_classes' => false ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize
+
+		return is_array( $unserialized ) ? $unserialized : array();
 	}
 }
diff --git a/templates/dashboard/account/settings/withdraw.php b/templates/dashboard/account/settings/withdraw.php
index 63f05b4a0a..18c247ba3f 100644
--- a/templates/dashboard/account/settings/withdraw.php
+++ b/templates/dashboard/account/settings/withdraw.php
@@ -28,8 +28,7 @@
 
 $get_saved_method_values = function ( $method_id, $user_id ) {
 	$meta_key = '_tutor_withdraw_method_data_' . $method_id;
-	$values   = get_user_meta( $user_id, $meta_key, true );
-	$values   = maybe_unserialize( $values );
+	$values   = WithdrawModel::get_user_withdraw_method_meta( $user_id, $meta_key );
 	return is_array( $values ) ? $values : array();
 };
 
diff --git a/templates/dashboard/account/withdrawals.php b/templates/dashboard/account/withdrawals.php
index 601e322eda..af2bb1d850 100644
--- a/templates/dashboard/account/withdrawals.php
+++ b/templates/dashboard/account/withdrawals.php
@@ -191,7 +191,7 @@
 				<?php if ( tutor_utils()->count( $withdral_history->results ) > 0 ) : ?>
 					<?php
 					foreach ( $withdral_history->results as $withdrawal ) :
-						$method_data  = maybe_unserialize( $withdrawal->method_data );
+						$method_data  = WithdrawModel::safe_unserialize_array( $withdrawal->method_data );
 						$method_key   = $method_data['withdraw_method_key'] ?? '';
 						$method_icon  = $method_icons[ $method_key ] ?? '';
 						$method_title = '';
diff --git a/views/pages/withdraw_requests.php b/views/pages/withdraw_requests.php
index da1513c3bb..d2115b1ce5 100644
--- a/views/pages/withdraw_requests.php
+++ b/views/pages/withdraw_requests.php
@@ -123,7 +123,7 @@
 						<?php foreach ( $withdraw_list->results as $list ) : ?>
 							<?php
 								$user_data = get_userdata( $list->user_id );
-								$details   = unserialize( $list->method_data );
+								$details   = WithdrawModel::safe_unserialize_array( $list->method_data );
 								$alert     = ( 'pending' == $list->status ? 'warning' : ( 'rejected' === $list->status ? 'danger' : ( 'approved' === $list->status ? 'success' : 'default' ) ) );
 								$data_name = isset( $details['account_name']['value'] ) ? $details['account_name']['value'] : $user_data->display_name;
 							if ( ! $details ) {

From f9d2bdf41d2a18b4e823269a43d93db4017a3104 Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Wed, 26 Aug 2026 13:31:12 +0600
Subject: [PATCH 6/7] Space and doc comment added

---
 classes/RestAPI.php      | 2 +-
 models/WithdrawModel.php | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/classes/RestAPI.php b/classes/RestAPI.php
index e2f818c58a..738bd02561 100644
--- a/classes/RestAPI.php
+++ b/classes/RestAPI.php
@@ -181,7 +181,7 @@ public function check_permission( $response, $handler, $request ) {
 	/**
 	 * Class loading
 	 *
-	 * Only autoloads Tutor REST API classes from the plugin's restapi/
+	 * @since 4.0.8 Only autoloads Tutor REST API classes from the plugin's restapi/
 	 * directory. Arbitrary class names must never resolve to files under
 	 * the plugin root (e.g. Composer packages used as POP gadgets).
 	 *
diff --git a/models/WithdrawModel.php b/models/WithdrawModel.php
index 57e72eaadb..088c980fa3 100644
--- a/models/WithdrawModel.php
+++ b/models/WithdrawModel.php
@@ -294,6 +294,7 @@ public static function get_withdrawals_history( $user_id = 0, $filter = array(),
 	 * @since 1.0.0
 	 *
 	 * @param int $user_id user id.
+	 *
 	 * @return bool|mixed
 	 */
 	public static function get_user_withdraw_method( $user_id = 0 ) {
@@ -313,6 +314,7 @@ public static function get_user_withdraw_method( $user_id = 0 ) {
 	 *
 	 * @param int    $user_id  User ID.
 	 * @param string $meta_key Meta key.
+	 *
 	 * @return array
 	 */
 	public static function get_user_withdraw_method_meta( $user_id, $meta_key ) {
@@ -342,6 +344,7 @@ public static function get_user_withdraw_method_meta( $user_id, $meta_key ) {
 	 * @since 4.0.8
 	 *
 	 * @param mixed $data Serialized string or already-decoded array.
+	 *
 	 * @return array
 	 */
 	public static function safe_unserialize_array( $data ) {

From 90b9099c9ce0386ee7d45e6fb5cb7e8456ea62a3 Mon Sep 17 00:00:00 2001
From: shewa <30765517+shewa12@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:23:51 +0600
Subject: [PATCH 7/7] Fix: Arbitary question or answer delete security
 vulnerability fixed

---
 classes/QuizBuilder.php | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/classes/QuizBuilder.php b/classes/QuizBuilder.php
index 2405da30bc..f1f234f905 100644
--- a/classes/QuizBuilder.php
+++ b/classes/QuizBuilder.php
@@ -322,7 +322,10 @@ public function save_questions( $quiz_id, $questions ) {
 				$wpdb->update(
 					$questions_table,
 					$question_data,
-					array( 'question_id' => $question_id )
+					array(
+						'question_id' => $question_id,
+						'quiz_id'     => $quiz_id,
+					)
 				);
 			}
 
@@ -334,7 +337,10 @@ public function save_questions( $quiz_id, $questions ) {
 			$wpdb->update(
 				$questions_table,
 				array( 'question_order' => $question_order ),
-				array( 'question_id' => $question_id )
+				array(
+					'question_id' => $question_id,
+					'quiz_id'     => $quiz_id,
+				)
 			);
 
 			// Save question's answers.
@@ -399,7 +405,7 @@ public function validate_payload( $payload ) {
 			$errors  = array_merge( $errors, $validation->errors );
 		}
 
-		if ( $quiz && ! empty( $questions ) ) {
+		if ( ! empty( $questions ) ) {
 			$this->set_current_quiz_questions_answer_ids( $quiz_id );
 			try {
 				$this->is_valid_quiz_question_answer_payload( $questions );
@@ -936,6 +942,7 @@ public function is_valid_quiz_question_answer_payload( array $payload ): bool {
 		$payload_question_ids     = wp_list_pluck( $payload, 'question_id' );
 		$payload_question_answers = wp_list_pluck( $payload, 'question_answers', 'question_id' );
 		$is_cb_question           = wp_list_pluck( $payload, 'is_cb_question', 'question_id' );
+
 		// Remove content bank answers.
 		$payload_question_answers = array_filter( $payload_question_answers, fn( $question_id ) => ! $is_cb_question[ $question_id ], ARRAY_FILTER_USE_KEY );
 		$payload_question_answers = array_values( $payload_question_answers );
@@ -945,6 +952,11 @@ public function is_valid_quiz_question_answer_payload( array $payload ): bool {
 		$payload_question_ids = array_filter( $payload_question_ids, fn( $id ) => is_numeric( $id ) && ! $is_cb_question[ $id ] );
 		$payload_answer_ids   = array_filter( $payload_answer_ids, fn( $id ) => is_numeric( $id ) );
 
+		// For the new quiz current_quiz is null, in this there should not be any numeric question or answer id.
+		if ( is_null( $this->current_quiz ) && ( count( $payload_question_ids ) || count( $payload_answer_ids ) ) ) {
+			throw new \Exception( esc_html__( 'Invalid question or answer id found', 'tutor' ), 1 );
+		}
+
 		if ( $this->current_quiz_question_ids ) {
 			$has_question_diff = array_diff( $payload_question_ids, $this->current_quiz_question_ids );
 			if ( $has_question_diff ) {