Tutor LMS CVE-2026-96537

No special configuration is required beyond running the affected component: any WordPress site with Tutor LMS at a version below 4.1.1 is exploitable by remote, unauthenticated users because the page-regeneration routine omits its capability check (CWE-862). The specific precondition is that the vulnerable page-regeneration/managed-pages routine is reachable, which it is by default on an installed plugin. Limiting factors: impact is confined to integrity of the plugin's managed pages and the options referencing them (force-publish, content overwrite, page creation, option changes) - there is no confidentiality or availability impact, and no code execution - so realistic damage is content tampering/defacement and manipulation of plugin page references rather than full site takeover. The only hard limiter is version: sites updated to 4.1.1 or later are not affected.

CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N - remote, low-complexity, unauthenticated, no user interaction - which makes this trivially reachable on any exposed WordPress site running a vulnerable Tutor LMS version. Impact is scoped to integrity only (C:N/I:H/A:N), consistent with the CWE-862 missing-authorization root cause: attackers tamper with content and plugin options rather than steal data or take the site down. Publicly available exploit code exists (POC=YES) and a patch is available from the vendor, so the barrier to opportunistic attacks is low. However, this is NOT confirmed actively exploited - it is absent from CISA KEV, so the correct status is 'publicly available exploit code exists,' not in-the-wild exploitation. EPSS score was NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified here; likewise no SSVC decision (exploitation/automatable/technical-impact) was supplied, so that framework cannot be cross-referenced. Net: this is a credible, easily-weaponized authorization flaw worth prompt patching given POC availability and unauthenticated network reach, but the integrity-only impact and lack of KEV/EPSS signals place it below the tier of data-exfiltration or RCE flaws under active mass exploitation.

An unauthenticated attacker sends a crafted request to the Tutor LMS page-regeneration routine on an exposed WordPress site, which fails to verify the caller's capabilities. Because a public POC exists and the flaw requires no authentication or user interaction, the attacker can force-publish hidden pages, overwrite existing managed page content (e.g. with defacement, spam, or malicious links), and rewrite the plugin options that reference those pages - all over the network at scale.