CVE-2026-96537: Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Tutor LMS versions before 4.1.1 are exposed. The affected routine can be reached without authentication.
What can an attacker do without an account?
An unauthenticated attacker can force-publish Tutor LMS-managed pages that are unpublished, overwrite their content, create missing managed pages, and alter the options that point to those pages.
Is a special WordPress role or capability required to exploit this?
No. The affected routine lacks a capability check, so authentication is not required.
How can I determine whether my site may have been affected?
Review Tutor LMS-managed pages for unexpected publication status or content changes, look for newly created managed pages, and check the plugin options that reference those pages for unexpected modifications.