CVE-2026-25406

WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability

Published Mar 25, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.

Analysis

Technical impact

The Tutor LMS Pro plugin contains a flaw that allows an attacker to bypass normal authentication, gaining unauthorized access to protected areas of the WordPress site. This weakness, classified as CWE-288, enables the compromise of course content, student data, and administrative settings.

Affected Systems

All installations of the Themeum Tutor LMS Pro plugin for WordPress with a version of 3.9.8 or earlier are affected. Site owners should immediately check the plugin version in the WordPress admin area and determine whether the installation is at risk.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests the likelihood of widespread exploitation is currently low. It is inferred that an attacker could exploit the vulnerability by sending a specially crafted request to an alternate URL or API endpoint that bypasses the plugin’s authentication checks. Successful exploitation would give the attacker full control over the plugin’s protected functions, potentially leading to data loss, content manipulation, or further compromise of the entire WordPress site. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Themeum

Tutor LMS Pro

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.9.4

No data.

Vendor Product Versions

Themeum

Tutor Lms

Version	Status	Scheme	Platform
`[0,3.9.4]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Tutor LMS Pro to any version newer than 3.9.8, which fixes the authentication bypass.
If the upgrade cannot be performed immediately, block access to the known alternative URLs or API endpoints that allow bypass using a web application firewall or host‑level rules.
Restrict administrative access to the Tutor LMS Pro plugin by applying role‑based access controls, ensuring only trusted users can invoke protected functionalities.

Generated by OpenCVE AI on April 28, 2026 at 21:57 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.363% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-9-4-broken-authentication-vulnerability?_s_id=cve

History

Apr 28, 2026 6:30 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.8.	Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
Title	WordPress Tutor LMS Pro plugin <= 3.9.8 - Broken Authentication vulnerability	WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability

Apr 28, 2026 1:15 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.	Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.8.
Title	WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability	WordPress Tutor LMS Pro plugin <= 3.9.8 - Broken Authentication vulnerability

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mar 26, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 26, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Themeum Themeum tutor Lms Wordpress Wordpress wordpress
Vendors & Products		Themeum Themeum tutor Lms Wordpress Wordpress wordpress

Mar 25, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
Title		WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability
Weaknesses		CWE-288
References		https://patchstack.com/database/Wordpress/Plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-9-4-broken-authentication-vulnerability?_s_id=cve