CVE-2026-14310
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify user access to the course a Q&A thread belongs to before returning or writing to that thread. Authenticated users with subscriber-level access and above who can access any single course can read Q&A threads of other courses and inject replies.
Risk Assessment
Confidential course discussions may be exposed to unauthorized users, and they can inject false replies, undermining educational content integrity.
Recommendation
Update the Tutor LMS plugin to version 4.0.0 or later.
Other vulnerabilities in Tutor LMS WordPress plugin
See all- CVE-2026-92715Medium
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
- CVE-2026-85571Medium
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages. This allows users with instructor-level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
- CVE-2023-3133High
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Original NVD description (English source)
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS