9.8
Critique
CVE-2026-0953 The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
Description
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Tutor LMS Pro 3.9 | premières → 3.9.5 | Pas de correctif indiqué |
Autres CVE de Tutor LMS Pro
Les 9 CVE de Tutor LMS Pro →
CVE-2026-22332
Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions
9.3
Critique
CVE-2026-25406
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows…
8.1
Élevée
CVE-2025-6639
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…
5.4
Moyenne
CVE-2025-6184
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL…
8.8
Élevée