The Tutor LMS WordPress plugin, versions prior to 4.1.1, contains a missing capability check in the routine that regenerates its managed pages. An unauthenticated visitor can trigger this routine, forcing unpublished pages to be published and overwriting their content, creating new pages, and updating options that point to those pages. The result is that an attacker can inject arbitrary content, deface the site, or alter configuration settings without any authentication. This is a classic case of improper authorization and may lead to loss of data integrity and site reputation.

All installations of Tutor LMS older than version 4.1.1 are affected. The vulnerability exists in the plugin's page regeneration routine, independent of the WordPress version or hosting environment, though this statement is inferred from the description. There are no known vendor patches listed in the CVE entry, but the plugin's maintainers have released version 4.1.1 to fix the issue.

Because the flaw allows actions with no authentication, the attack vector is a simple HTTP request to the page regeneration endpoint. The CVSS score is not provided, the EPSS score is not available, and KEV is not listed in KEV, so the exact risk rating cannot be quantified; however, the intrinsic severity is high due to the lack of access control. Attackers with HTTP access could exploit this immediately once they discover the vulnerable endpoint. Prompt remediation is recommended.