Skip to content
fr Sign in
4.3 Medium

CVE-2026-14306 The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected…

Description

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS 3.9 earliest → < 3.9.14 3.9.14

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tutor LMS

The 18 CVEs of Tutor LMS →
CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure 4.3 Medium CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its… 7.5 High CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering… 6.5 Medium CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to… 7.2 High
Track this CVE