CVE-2026-96537

Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

Affected

Tutor LMS

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.21% chance of exploitation in the next 30 days, 10th percentile

Published

2026-10-15

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e25ac9a8-a29d-4573-9d04-402a14515fb7/

References

• CVE Record
• NVD entry