Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:tutor_lms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Tutor Lms (507b2952-76fd-5cbf-b82f-59646d345900) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14306 |
vulnerable | 2026-09-16 04:33:12.131364 |
Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
MEDIUM (4.3)
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.
Published: 2026-08-06T16:49:01.735Z
Updated: 2026-08-07T13:58:56.149Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14310 |
vulnerable | 2026-09-16 04:33:12.107414 |
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Published: 2026-07-30T06:00:13.058Z
Updated: 2026-07-30T13:04:36.033Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12275 |
vulnerable | 2026-07-29 00:23:32.230063 |
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
Published: 2026-07-13T06:00:02.528Z
Updated: 2026-07-13T15:46:49.109Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12274 |
vulnerable | 2026-07-29 00:23:32.229958 |
Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Published: 2026-07-13T06:00:02.352Z
Updated: 2026-07-13T15:48:20.554Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12273 |
vulnerable | 2026-07-29 00:23:32.229833 |
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
Published: 2026-07-13T06:00:02.180Z
Updated: 2026-07-13T15:51:16.393Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12271 |
vulnerable | 2026-07-29 00:23:32.229530 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4805 |
vulnerable | 2026-06-08 06:16:14.603711 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3133 |
vulnerable | 2026-06-08 06:09:38.643738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0236 |
vulnerable | 2026-06-08 05:52:04.578304 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.