What is the CVSS score of CVE-2026-25406?

CVE-2026-25406 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tutor LMS Pro are affected by CVE-2026-25406?

Tutor LMS Pro WordPress plugin versions through 3.9.4 contain an authentication bypass vulnerability (CVSS 8.1) that could allow attackers to gain unauthorized administrative access to learning…

How to fix or mitigate CVE-2026-25406?

Within 24 hours: Identify all WordPress instances running Tutor LMS Pro and document current version numbers. Within 7 days: Contact Tutor LMS vendor for patch availability timeline and interim security guidance; implement Web Application Firewall rules to restrict administrative interface access to known IP ranges. Within 30 days: Apply vendor patch immediately upon release; if no patch released by day 30, consider disabling the plugin or migrating to alternative LMS solutions pending vendor remediation.

Tutor LMS Pro CVE-2026-25406

EUVD-2026-15717 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-25 Patchstack

GHSA-gfhq-r659-4ww9

Authentication Bypass Tutor Lms Pro

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 13:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 28, 2026 - 02:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 16:12 NVD

8.8 (HIGH) 8.1 (HIGH)

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15717

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.

AnalysisAI

Authentication bypass in Tutor LMS Pro WordPress plugin (versions through 3.9.4) allows remote attackers to abuse authentication mechanisms via alternate paths, potentially gaining unauthorized administrative access. CVSS 8.1 reflects high attack complexity (AC:H) requiring specific conditions, yet successful exploitation grants complete system compromise (C:H/I:H/A:H). EPSS probability of 0.02% (6th percentile) indicates low observed exploitation activity. No active exploitation confirmed by CISA KEV. SSVC framework classifies this as non-automatable with total technical impact, making it a priority for organizations running this WordPress LMS plugin despite low real-world exploitation signals.

Technical ContextAI

This vulnerability affects Tutor LMS Pro, a WordPress Learning Management System plugin by Themeum (CPE: cpe:2.3:a:themeum:tutor_lms_pro). The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), which occurs when applications provide multiple authentication mechanisms or paths but fail to consistently enforce authentication across all entry points. In WordPress plugin contexts, this typically manifests when REST API endpoints, AJAX handlers, or alternative request processing paths lack proper authentication checks that exist in primary application flows. The network attack vector (AV:N) indicates the alternate authentication path is accessible remotely, likely through unauthenticated HTTP requests to specific plugin endpoints or parameters that bypass normal WordPress authentication hooks.

RemediationAI

Upgrade Tutor LMS Pro WordPress plugin to version 3.9.5 or later, which addresses the authentication bypass vulnerability per Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-9-4-broken-authentication-vulnerability). Organizations unable to immediately patch should implement WordPress-level compensating controls: restrict plugin administrative functions to trusted IP addresses using web application firewall rules targeting tutor-pro plugin paths, disable unauthenticated REST API access to tutor-lms endpoints via custom mu-plugins or security plugins (note: may break legitimate course browsing functionality for unauthenticated users), and enable comprehensive WordPress audit logging to detect unauthorized administrative actions on LMS courses, users, or settings. These mitigations carry functional trade-offs-IP restrictions prevent remote administration, REST API blocking may impact mobile apps or integrations-making vendor patch the strongly preferred solution.