Tutor LMS EUVD-2026-40893

Exploitation requires a WordPress user account with at minimum author-level role, specifically one that has permission to create or edit lessons and upload attachments within the Tutor LMS plugin. The affected functionality is the Lesson Attachment Title field - it must be possible for the attacker to set or modify this field in a lesson. A victim must subsequently access a course page that renders the attachment (e.g., a student or administrator viewing lesson content), which constitutes the UI requirement. Exploitation is therefore limited by: (1) the attacker must hold or obtain an authenticated author-level or higher account on the target WordPress site; (2) the Tutor LMS plugin must be installed, active, and in a version ≤ 3.9.13; (3) at least one victim must load the page containing the injected attachment. Sites that restrict author-role registration or require manual approval of course-creation accounts significantly reduce real-world exploitability beyond the raw CVSS score suggests.

The NVD-assigned CVSS 3.1 score of 6.4 (Medium) reflects a network-delivered, low-complexity attack requiring only low privilege (author role) with a scope change that grants limited confidentiality and integrity impact against victims. The UI:N metric in the provided vector is debatable for stored XSS - victim page-access is an implicit prerequisite - which suggests a more accurate score is approximately 5.4 with UI:R applied. EPSS data was not included in this advisory; without it, broad exploitation probability must be inferred from contextual signals: author-level WordPress roles are relatively easy to obtain on sites that permit open course-author registration (common in eLearning deployments), and the Wordfence advisory directly links to the vulnerable lines of code, functioning as near-equivalent disclosure. KEV status is absent, indicating no confirmed mass exploitation. Exploitation is not automatable against arbitrary targets - it requires an account - but against platforms with open author registration, the effective barrier is low. Overall: a real, prioritized risk for eLearning sites that allow self-serve course-author registration; lower urgency for sites where author accounts are tightly controlled.

An attacker registers or compromises an author-level WordPress account on a site running Tutor LMS 3.9.13 or earlier, then creates or edits a lesson and names an attachment with a crafted title such as a script injection payload. The payload is saved to the WordPress database without sanitization. When any site visitor - including administrators - views the affected lesson page, the attachment title is rendered without escaping, causing the injected script to execute in their browser, potentially exfiltrating session cookies or performing authenticated actions on their behalf. No public proof-of-concept exploit was identified in the provided data, but the Wordfence advisory directly identifies the vulnerable code lines, substantially lowering independent exploit development effort.