What is the CVSS score of CVE-2026-3358?

CVE-2026-3358 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-3358

MEDIUM

Missing Authorization (CWE-862)

2026-04-11 Wordfence

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:24 nvd

MEDIUM 5.4

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the enroll_now() and course_enrollment() functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a private post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the read_private_posts capability.

AnalysisAI

Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.

Technical ContextAI

The vulnerability exists in the enroll_now() and course_enrollment() functions within the Tutor LMS plugin's Course.php class. These endpoints perform nonce verification, user authentication checks, and purchasability validation but fail to implement CWE-862 (Missing Authorization) by omitting verification of the course's post_status field. In WordPress, posts with private post_status should only be readable by users with the read_private_posts capability; Tutor LMS does not enforce this restriction at the enrollment layer. While WordPress core access control prevents direct content viewing (returning 404), the enrollment record created in the database and metadata exposure in the subscriber dashboard constitute unauthorized information disclosure and unauthorized state modification.

RemediationAI

Vendor-released patch: Tutor LMS version 3.9.8 or later. Sites running version 3.9.7 or earlier must upgrade immediately to 3.9.8 to apply post_status validation in the enrollment functions. The patch corrects the enroll_now() and course_enrollment() functions to verify that enrolled courses are not in private post_status before allowing enrollment by Subscriber-level users. WordPress administrators can verify the patch is in place by reviewing the Course.php file at the relevant code locations (https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ftutor/tags/3.9.8). No workarounds are available; patching is the only remediation. Detailed advisory information is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/0c173356-7228-4253-bb28-2c2e11af76fd?source=cve.