Skip to content
fr Sign in
4.3 Medium

CVE-2026-85572 The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its…

Description

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS 4.0 4.0.0 → < 4.0.8 4.0.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tutor LMS

The 18 CVEs of Tutor LMS →
CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure 4.3 Medium CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its… 7.5 High CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering… 6.5 Medium CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to… 7.2 High
Track this CVE