The vulnerability is an access control flaw that allows an authenticated user with tutor-level permissions or higher to view assignments for courses they are not authorized to teach. This exposes potentially sensitive student data stored in those assignments. The weakness maps to CWE-284. No remote code execution or denial‑of‑service effect is described, so the impact is limited to confidentiality loss.

All installations of the Tutor LMS – eLearning and online course solution plugin for WordPress up to and including version 3.8.3 are affected. The plugin is available as a free WordPress add‑on and uses a role hierarchy that includes a tutor role.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker must first authenticate and possess a tutor or higher role before the exposure can occur, so the attack vector is post‑authentication. The risk is primarily the accidental or malicious disclosure of assignment content to unintended users.