Tutor Lms

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

Published: 2026-10-15T06:00:14.929Z
Updated: 2026-10-15T11:01:27.071Z

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

Published: 2026-09-16T06:00:14.648Z
Updated: 2026-09-17T12:35:44.379Z

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.

Published: 2026-09-16T06:00:14.474Z
Updated: 2026-09-17T12:36:00.983Z

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Published: 2026-08-06T16:49:01.735Z
Updated: 2026-08-07T13:58:56.149Z

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.

Published: 2026-07-30T06:00:13.058Z
Updated: 2026-07-30T13:04:36.033Z