Tutor LMS CVE-2026-42698

Requires an authenticated account with at least low privileges on the target WordPress site (CVSS PR:L) - the flaw is not exploitable by fully unauthenticated visitors. Exploitation further depends on triggering a concurrency/race window in Tutor LMS's handling of a shared resource (CWE-362), reflected by AC:H: the attacker must send overlapping concurrent requests and win a timing race, which is non-deterministic and non-automatable per SSVC. No end-user interaction is needed (UI:N). Limiting factors: the required authentication, the probabilistic timing window, and impact confined to integrity (no confidentiality or availability loss) all reduce realistic risk below the raw base score.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.3) describes a network-reachable but high-complexity flaw requiring low-level authentication, with impact limited to integrity (C:N/A:N). All exploitation signals point low: SSVC from CISA's framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the CWE-362 race-condition nature - exploitation depends on winning a timing window, consistent with AC:H. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so there is no public exploit identified at the time of analysis. The signals are mutually consistent rather than conflicting: high attack complexity, required authentication, non-automatable exploitation, and partial technical impact all reinforce a below-median real-world risk despite network reachability. One cross-source tension to verify: the Patchstack tag set includes 'Information Disclosure' (a confidentiality concern), yet the CVSS vector sets C:N and I:H (integrity only) - the tag appears inconsistent with the scored impact and should be verified against the Patchstack advisory.

A low-privileged authenticated user (e.g., a registered student/subscriber) repeatedly issues concurrent requests to a vulnerable Tutor LMS endpoint, racing to interleave operations on a shared resource that lacks proper synchronization. By winning the timing window, the attacker manipulates application state or data in a way the single-threaded logic would normally prevent, corrupting integrity. No public exploit code is referenced, and the high complexity (AC:H) means reliable exploitation requires repeated attempts to hit the race window.