CVE-2026-40740

WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

Published Apr 15, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.

Analysis

Technical impact

Missing authorization in the Tutor LMS plugin for WordPress allows an attacker to bypass intended access restrictions and read or modify data that should be protected. The flaw arises from incorrectly configured access control security levels, enabling users with insufficient privileges to perform privileged actions. The weakness is classified as CWE-862, a missing authorization issue.

Affected Systems

The vulnerability affects the Themeum Tutor LMS plugin for WordPress, versions up to and including 3.9.7. Any installation running these versions is susceptible; newer releases are not impacted.

Risk and Exploitability

The assessment indicates medium severity and a low likelihood of exploitation. The plugin operates in a web environment, so the likely attack vector is remote, accessed via HTTP requests to the WordPress site. An attacker who can log in with a limited role or trick a user into visiting specific URLs may exploit the broken access control to obtain unauthorized data or perform administrative actions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Themeum

Tutor LMS

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.9.7

No data.

Vendor Product Versions

Themeum

Tutor Lms

Version	Status	Scheme	Platform
`[0,3.9.7]`	affected	semver	—
`[3.9.8,*]`	unaffected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Tutor LMS plugin to version 3.9.8 or later.
If an upgrade is not immediately possible, restrict the plugin’s functionality to trusted roles by adjusting WordPress user permissions or employ a role‑management plugin to block unauthorized access.
Review access logs for unusual activity and monitor users who gain elevated privileges outside of normal patterns.

Generated by OpenCVE AI on April 17, 2026 at 08:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.184% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-7-broken-access-control-vulnerability?_s_id=cve

History

Apr 16, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 15, 2026 1:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Themeum Themeum tutor Lms Wordpress Wordpress wordpress
Vendors & Products		Themeum Themeum tutor Lms Wordpress Wordpress wordpress

Apr 15, 2026 10:45 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.
Title		WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-7-broken-access-control-vulnerability?_s_id=cve