Tutor LMS EUVD-2026-36974

No special conditions are required beyond the Tutor LMS plugin (version 3.9.7 or earlier) being installed and active on a WordPress site reachable over the network. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default plugin configurations with no elevated privileges or user interaction. Exploitation is limited to WordPress sites running this plugin in the affected version range; sites not running Tutor LMS are not affected. The impact is bounded by the plugin's data scope - LMS course, enrollment, and user data - rather than full WordPress site compromise, as the CVSS scope is Unchanged (S:U). The specific endpoint or action hook triggering the missing authorization check has not been disclosed in currently available public data.

The CVSS 3.1 score of 6.5 (Medium) is consistent with the network-accessible, unauthenticated nature of the flaw but bounded by limited-scope impact (C:L/I:L/A:N, S:U). The PR:N and AC:L metrics indicate this is trivially reachable by any internet user, which elevates real-world risk despite the medium severity score. EPSS data was not provided, so exploitation probability cannot be quantified numerically. The vulnerability is not currently listed in the CISA KEV catalog, and no public POC has been identified, which tempers urgency somewhat. However, WordPress plugins with unauthenticated broken access control are a well-understood attack class frequently targeted by automated scanners and mass exploitation campaigns - the absence of a known exploit today does not guarantee safety. Patchstack (the reporter) specializes in WordPress security, lending credibility to the disclosure. The combination of unauthenticated access and integrity impact (I:L) means an attacker could potentially manipulate course content, user enrollments, or other LMS data without credentials, which represents a meaningful business risk for educational platforms.

An unauthenticated remote attacker sends a crafted HTTP request directly to an exposed WordPress REST API endpoint or AJAX handler within the Tutor LMS plugin, bypassing the missing authorization check. Because no credentials, user interaction, or special network position are required, this can be performed by automated scanners hitting any publicly reachable WordPress site running the vulnerable plugin version. The attacker can then read restricted course data or modify LMS records - such as enrollment status or quiz results - without any valid account.