EUVD-2026-51016
GHSA-96xm-q386-833c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible endpoint, low complexity; PR:L because subscriber account is required; no availability impact; partial C and I from thread read and reply injection.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
AnalysisAI
Broken object-level authorization in the Tutor LMS WordPress plugin (all versions before 4.0.0) allows any authenticated subscriber-level user to read Q&A threads and inject replies into courses they are not enrolled in or authorized to access. Exploitation requires only a valid WordPress account, making the barrier low for multi-tenant LMS deployments where user registration is open. A publicly available proof-of-concept exists per WPScan, and while not listed in CISA KEV, the low authentication requirement and POC availability elevate realistic risk for exposed installations.
Technical ContextAI
Tutor LMS is a widely used WordPress learning management system plugin. The affected component is its Q&A thread system, which is tied to course enrollment. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), an Insecure Direct Object Reference (IDOR) class flaw: the plugin accepts a user-supplied course or thread identifier in requests but does not validate that the requesting user is enrolled in or authorized to access the course that thread belongs to. The CPE cpe:2.3:a:unknown:tutor_lms:*:*:*:*:*:*:*:* covers all versions prior to 4.0.0. The 'Code Injection' tag refers to the reply-injection capability - attackers can write arbitrary content into Q&A threads of courses they do not own - but this is content/message injection rather than server-side code execution.
RemediationAI
Update the Tutor LMS WordPress plugin to version 4.0.0 or later; this is the vendor-confirmed fix as documented in the WPScan advisory (https://wpscan.com/vulnerability/8fa51eaf-5205-492c-bcf7-81136dbf12d4/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14310). Update via the WordPress plugin dashboard or by downloading directly from the Themeum plugin repository. If immediate patching is not possible, a compensating control is to disable open user registration so that obtaining a subscriber account requires administrative approval, raising the barrier for unauthenticated external attackers - note this does not protect against already-registered users. Additionally, restricting REST API or AJAX endpoints associated with Q&A functionality via a WAF or firewall rule to authenticated-and-enrolled users only can reduce exposure, though the specific endpoints to block should be confirmed against plugin documentation.
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers o
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Several AJAX endpoints in the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7.7 were unprot
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowi
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-le
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS - eLearning and online course soluti
The tutor_place_rating AJAX action from the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS - eLearning and online course solution WordPress
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today