CVE-2026-14306: Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tutor LMS WordPress pluginto a version that resolves this vulnerability.Fixed in 3.9.14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14306?
CVE-2026-14306 has a medium severity rating of 4.3.
How does CVE-2026-14306 affect users?
CVE-2026-14306 allows authenticated users with subscriber-level access and above to bypass enrollment checks and access paid content.
What versions of Tutor LMS are vulnerable to CVE-2026-14306?
Tutor LMS versions prior to 3.9.14 are vulnerable to CVE-2026-14306.
How can I fix CVE-2026-14306?
To fix CVE-2026-14306, update the Tutor LMS WordPress plugin to version 3.9.14 or later.
What type of vulnerability is CVE-2026-14306?
CVE-2026-14306 is an access control vulnerability that allows unauthorized access to protected course content.