Improper Access Control in Tutor LMS Plugin by WordPress
CVE-2026-14306
4.3MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14306?
The Tutor LMS WordPress plugin prior to version 3.9.14 contains a flaw in its access control mechanism. The vulnerability allows authenticated users who have subscriber-level access or higher and are enrolled in at least one course to bypass restrictions on protected content. This misconfiguration permits unauthorized access to paid lessons, quizzes, and assignments from other courses, potentially exposing sensitive educational materials.
Affected Version(s)
Tutor LMS 0 < 3.9.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
John Umoru
WPScan