5.4
Medium
CVE-2026-14310 The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A…
Description
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tutor LMS 4.0 | earliest → < 4.0.0 | 4.0.0 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Tutor LMS
The 18 CVEs of Tutor LMS →
CVE-2026-85570
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
4.3
Medium
CVE-2026-96537
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its…
7.5
High
CVE-2026-85571
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering…
6.5
Medium
CVE-2026-85569
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to…
7.2
High