Skip to content
Sign in
9.8 Critical

CVE-2026-0953 The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…

Description

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS Pro 3.9 earliest → 3.9.5 No fix stated

Other CVEs of Tutor LMS Pro

The 9 CVEs of Tutor LMS Pro →
CVE-2026-22332 Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions 9.3 Critical CVE-2026-25406 Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows… 8.1 High CVE-2025-6639 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object… 5.4 Medium CVE-2025-6184 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL… 8.8 High
Track this CVE