CVE-2026-14310
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify user access to the course a Q&A thread belongs to before returning or writing to that thread. Authenticated users with subscriber-level access and above who can access any single course can read Q&A threads of other courses and inject replies.
Risk Assessment
Confidential course discussions may be exposed to unauthorized users, and they can inject false replies, undermining educational content integrity.
Recommendation
Update the Tutor LMS plugin to version 4.0.0 or later.
Other vulnerabilities in Tutor LMS WordPress plugin
Original NVD description (English source)
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS