CVE-2026-14306

Deferred Deferred - Pending Action

Tutor LMS Unauthorized Course Content Access Vulnerability

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-14306

Affected Vendors & Products

Vendor	Product	Version / Range
themeum	tutor_lms	to 3.9.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The Tutor LMS WordPress plugin before version 3.9.14 has a flaw where it fails to properly check if a user is enrolled in a specific course before allowing access to its paid content. This means users with subscriber-level access or higher who are enrolled in at least one course can view lesson, quiz, and assignment content from other courses they are not enrolled in.

Detection Guidance

Check if your Tutor LMS plugin is updated to version 3.9.14 or higher. Review course access logs for unauthorized access to paid content by non-enrolled users. Inspect WordPress user roles and course enrollment permissions for misconfigurations.

Impact Analysis

If you use the Tutor LMS plugin before 3.9.14, unauthorized users may access paid course materials without paying. This could lead to financial losses for course creators and undermine trust in the platform. Users might also gain access to content they are not supposed to see.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA if it leads to unauthorized access to sensitive or personal information in course content. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if such breaches occur.

Mitigation Strategies

Update the Tutor LMS WordPress plugin to version 3.9.14 or later to fix the enrollment verification issue.

Hi! I’m here to help you understand CVE-2026-14306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70