Page Management Vulnerability in Tutor LMS Plugin for WordPress
CVE-2026-96537
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-96537?
The Tutor LMS plugin for WordPress, in versions prior to 4.1.1, has a critical weakness in its page management system. This vulnerability allows unauthenticated users to bypass intended restrictions and manipulate unpublished content. Specifically, these users can forcefully publish pages, overwrite existing content, create new pages, and alter configuration settings that govern page display. This poses a significant risk for site integrity and content management, making it essential for users to update to the latest version.
Affected Version(s)
Tutor LMS 0 < 4.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.