The Tutor LMS WordPress plug‑in vulnerability allows authenticated subscribers and higher roles to read and inject replies into Q&A threads belonging to courses they are not enrolled in. The flaw arises because the plugin does not verify that the user has access to a thread's course before retrieving or writing data. Consequently, confidentiality of Q&A content is violated and an attacker can manipulate discussions across courses. This weakness maps to CWE‑639, manipulation of privileged information.

Unauthorized users can exploit this flaw in any installation of the Tutor LMS plug‑in where the version is older than 4.0.0, regardless of the WordPress version. The vulnerability applies to any site that enables the cross‑course Q&A feature and has subscriber role users with course access.

With a CVSS score of 5.4 the vulnerability is of moderate severity, and its EPSS score of less than 1% indicates that exploit attempts are currently rare. The flaw requires authentication and a role that allows course access; an attacker would first need to log in with a subscriber or higher account. Once authenticated, the vulnerability can be used to read or alter Q&A threads in any course, providing a modest but meaningful attack surface.