Description
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
Published: 2026-08-22
Score: 2.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The Tutor LMS WordPress plugin contains an Insecure Direct Object Reference flaw that fails to enforce per-object ownership checks on its course content type. Any user with the instructor role can read the content of private courses owned by other instructors, potentially disclosing confidential course material.

Affected Systems

The affected product is the Tutor LMS WordPress plugin. All installations running any version prior to 4.0.6 are susceptible; no specific patch level is provided beyond this version boundary.

Risk and Exploitability

The vulnerability can be exploited by any authenticated instructor through the web interface, as the plugin does not validate ownership of the requested course. The EPSS score is <1% and the CVSS score is 2.7, indicating low severity, and the vulnerability is not listed in the CISA KEV catalog. The low EPSS score indicates a low probability of exploitation. The likely attack vector is remote via the web application, requiring only instructor credentials.

Generated by OpenCVE AI on August 23, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Tutor LMS plugin to version 4.0.6 or newer, which includes the necessary ownership checks.
  • If an upgrade is not immediately possible, restrict the instructor role or disable the ability to create or manage private courses until a patch is applied.
  • Implement additional server‑side validation to verify that the current instructor owns or is authorized to view a requested course before serving its content.

Generated by OpenCVE AI on August 23, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 23 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sun, 23 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 22 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Sat, 22 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
Title Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-23T15:27:57.521Z

Reserved: 2026-06-30T08:17:41.878Z

Link: CVE-2026-14187

cve-icon Vulnrichment

Updated: 2026-08-23T15:25:03.479Z

cve-icon NVD

Status : Deferred

Published: 2026-08-22T06:16:11.597

Modified: 2026-08-26T16:30:52.723

Link: CVE-2026-14187

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-23T19:30:05Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key