Tutor LMS CVE-2026-14310

Exploitation requires an authenticated WordPress account at subscriber level or above - a user with no special role beyond being registered on the site. The attacker must also be able to access at least one single course (as stated in the description), which may be a free course, a trial course, or any other course the subscriber is legitimately enrolled in. The attacker must be able to enumerate or guess valid course/Q&A thread identifiers, which in WordPress-based systems are typically sequential integers, reducing the difficulty. What limits exploitation: anonymous/unauthenticated users cannot exploit this; sites with closed user registration or invite-only enrollment significantly reduce the external threat surface; the attack is not automatable at scale per SSVC assessment; and there is no confidentiality or integrity impact beyond course Q&A content (no server-side code execution or privilege escalation).

The NVD CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is well-calibrated: network-reachable, low complexity, but requires authenticated access at subscriber level (PR:L), with no scope change and only partial confidentiality and integrity impact. The SSVC assessment (Exploitation: poc, Automatable: no, Technical Impact: partial) correctly notes that while a POC exists, the attack is not trivially automatable at scale - an attacker must enumerate valid course/thread IDs. There is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been reported. Real-world priority is moderate-to-high for sites with open user registration, as subscriber accounts are trivially obtainable. For closed-registration or private LMS instances the realistic threat surface is materially smaller. EPSS data was not provided in the input; exploitation probability cannot be quantified here.

An attacker registers or already holds a subscriber-level WordPress account on a Tutor LMS site. Using the publicly available WPScan proof-of-concept as a reference, the attacker crafts HTTP requests to the Q&A endpoint substituting thread or course IDs they enumerate (e.g., by incrementing numeric IDs), bypassing the enrollment check and reading confidential Q&A content from paid or restricted courses. The attacker can also inject replies into those threads, potentially distributing misinformation or phishing content to enrolled students.