Tutor LMS Pro EUVD-2026-15717

High attack complexity (AC:H) in CVSS vector indicates exploitation requires specific preconditions beyond default WordPress installations. The authentication bypass likely depends on one or more factors: specific Tutor LMS Pro feature being enabled (such as frontend course management, student registration workflows, or instructor dashboard), particular plugin configuration settings that expose alternate authentication paths, precise timing or sequence of requests exploiting race conditions in authentication state management, or interaction with specific WordPress REST API endpoints unique to the plugin's architecture. The vulnerability is NOT exploitable against all default installations-attackers must identify sites where the vulnerable code path is active and accessible. Limiting factors include: network-accessible WordPress installation running Tutor LMS Pro versions through 3.9.4, no user interaction required (UI:N) suggesting server-side exploitation, but the AC:H designation confirms typical automated scanners cannot trivially exploit this without environment-specific reconnaissance.

Real-world risk assessment reveals notable divergence between severity scoring and exploitation probability. CVSS 8.1 indicates critical impact if exploited (complete confidentiality, integrity, and availability compromise), but high attack complexity (AC:H) suggests specific preconditions or race conditions must be met. EPSS score of 0.02% places this in the 6th percentile-96% of vulnerabilities have higher exploitation probability-indicating security researchers and attackers have not widely targeted this flaw. CISA KEV status is negative, confirming no federal agency observations of active exploitation. SSVC framework marks exploitation status as 'none' and automatable as 'no', reinforcing that this requires manual attacker effort and is not being mass-scanned. The 'total' technical impact classification reflects the authentication bypass nature. This creates a paradox: organizations running Tutor LMS Pro face potential complete compromise, but the attack difficulty and lack of observed exploitation suggest attackers are not successfully weaponizing this at scale. Priority should be HIGH for sites using this specific plugin (especially with administrative course management), but MODERATE in broader vulnerability management programs compared to actively exploited flaws.

Attacker identifies WordPress site running Tutor LMS Pro 3.9.4 through plugin enumeration via wp-content/plugins/tutor-pro path disclosure. Leveraging knowledge of the alternate authentication channel, attacker crafts HTTP requests to plugin-specific endpoints (likely REST API routes or AJAX handlers) that bypass WordPress's standard authentication hooks. Due to high attack complexity (AC:H), exploitation requires identifying the specific vulnerable endpoint combination, parameter manipulation, or race condition-potentially through source code review or trial-and-error probing. Upon successful bypass, attacker gains authenticated session context with elevated privileges, enabling course content manipulation, student data access, or administrative function abuse without valid credentials.