Tutor LMS CVE-2026-93681

Exploitation requires (1) an authenticated account with at least subscriber-level access, typically obtainable where open user registration is enabled; (2) the Tutor LMS Legal Consent / GDPR logging feature to be in use, since a Legal Consent record must exist for the attacker's account to make the 'View Logs' button appear in the Consent Logs column of wp-admin/users.php; and (3) an administrator (or other privileged user) to view that consent log page, which triggers the stored payload. Limiting factors: this is not exploitable against default configurations lacking consent logging, it requires an existing low-privilege account, and the payload only executes when a privileged user accesses the affected admin page - materially narrowing the attacker population and the realistic window versus a pure unauthenticated stored XSS.

This is a moderate-severity stored XSS (CVSS 6.4, CWE-79) whose real-world priority is tempered by meaningful preconditions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable exploitation by an authenticated subscriber-level user, with a scope change reflecting that injected script executes in a higher-privileged admin's browser context. No EPSS score, SSVC decision, or KEV entry was supplied, and there is no public exploit identified at time of analysis, so there is no evidence of active or automatable exploitation - exploitation status is 'no public exploit identified at time of analysis.' A key mitigating/conflicting signal: the CVSS vector sets UI:N, but the description shows exploitation depends on an administrator navigating to the Consent Logs column in wp-admin/users.php and clicking (or rendering) the 'View Logs' view, which practically resembles victim-side interaction - this nuance is not captured by UI:N and should be verified against Wordfence's scoring rationale. Additionally, a Legal Consent record must already exist for the attacker's account, further narrowing applicability. Net: a legitimate but not urgent issue - a self-registering low-privilege user can escalate against an admin, but only in GDPR/consent-logging deployments and only when an admin views the logs. Treat as a routine-priority patch, prioritized higher on sites with open registration and active consent logging.

On a Tutor LMS site that allows open subscriber registration and uses the Legal Consent/GDPR logging feature, an attacker registers an account and sets a malicious display_name containing script. Once a Legal Consent record exists for that account, the 'View Logs' button surfaces in the Consent Logs column of wp-admin/users.php, and the attacker's unsanitized display_name executes in the administrator's browser when they review the consent logs. No public exploit code was identified at time of analysis.