Tutor Lms Elearning And Online Course Solution CVE-2026-3358

CVSS 5.4 (Medium) reflects network-accessible endpoints with low attack complexity and low privilege requirements, limited to confidentiality and integrity impacts without availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) confirms unauthenticated access is NOT required-only Subscriber-level role is needed, a common default permission tier in WordPress installations. Real-world risk is moderate but operationally significant: the vulnerability enables privilege escalation within the WordPress permission model by allowing Subscribers to gain unauthorized access to course enrollment records and private course metadata intended only for administrators or instructors. SSVC considerations: exploitation is straightforward (no special conditions needed beyond valid Subscriber credentials), the technical impact is focused (enrollment data exposure, not remote code execution), but organizations using private courses for access-controlled content face direct confidentiality and integrity compromise. No KEV status or active exploitation confirmation provided, suggesting this is not yet widely exploited in the wild, though the low barrier to exploitation (standard WordPress Subscriber role) makes post-patch deployment critical.

An authenticated user with WordPress Subscriber-level role (the default for site users) sends a crafted POST request to the enrollment endpoint with a private course ID, bypassing the missing post_status check. The enrollment record is created in the database, and the private course title and enrollment status now appear in the attacker's subscriber dashboard, leaking metadata about restricted content. While WordPress core access control prevents the Subscriber from viewing the actual course materials (returning 404 on access attempts), the enrollment record and metadata exposure constitutes unauthorized information disclosure about the private course structure and enrollment state.