CVE-2026-14310: Tutor LMS Auth Bypass Vulnerability

CVE-2026-14310 Overview

CVE-2026-14310 affects the Tutor LMS WordPress plugin in versions before 4.0.0. The plugin fails to verify that an authenticated user has access to the course tied to a Question and Answer (Q&A) thread before reading or writing to it. Authenticated users with subscriber-level access or higher who can access any single course on the site can read Q&A threads belonging to other courses and inject replies into them. The flaw is a broken access control issue tied to missing authorization checks on Q&A operations.

Critical Impact
Any authenticated subscriber enrolled in one course can read and post to private Q&A threads across all other courses on the site.

Affected Products

Tutor LMS WordPress plugin, all versions prior to 4.0.0
WordPress sites running Tutor LMS with course-based Q&A enabled
Learning platforms where subscriber registration is open to the public

Discovery Timeline

2026-07-30 - CVE-2026-14310 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14310

Vulnerability Analysis

The vulnerability is a broken access control flaw in the Tutor LMS Q&A subsystem. The plugin exposes endpoints that read from and write to Q&A threads associated with individual courses. These endpoints validate that the caller is authenticated but do not confirm that the caller has access to the specific course whose Q&A thread is being manipulated. As a result, an authenticated user who has enrolled in or been granted access to any single course inherits the ability to interact with Q&A threads on every other course.

The issue maps to Insecure Direct Object Reference (IDOR) and Missing Authorization patterns. The identifier used to select the target Q&A thread is trusted from the request without a corresponding entitlement check against the associated course. Both read paths (returning thread contents) and write paths (posting replies into threads) are affected.

Root Cause

The root cause is a missing authorization check between the Q&A thread identifier supplied in the request and the course that owns the thread. Access control logic verifies session identity and subscriber role, but does not resolve the parent course of the target thread and confirm enrollment or instructor status against that course.

Attack Vector

An attacker registers or already holds a subscriber-level account and gains access to any one course on the target site. The attacker then issues requests to the Q&A endpoints, substituting the thread identifier with those of threads belonging to unrelated courses. The server returns thread contents or accepts injected replies without validating course-level access. Exploitation requires authentication but no elevated role, no user interaction from victims, and no local access.

No public proof-of-concept code is currently available. Refer to the WPScan Vulnerability Reference for technical details.

Detection Methods for CVE-2026-14310

Indicators of Compromise

Q&A thread replies authored by user accounts that are not enrolled in the parent course.
Access log entries showing subscriber accounts issuing sequential or enumerated requests against Tutor LMS Q&A endpoints.
Unexpected reply activity across multiple courses originating from a single low-privilege account within a short time window.

Detection Strategies

Review the wp_posts and Tutor LMS Q&A tables for replies where the author lacks a corresponding enrollment record for the parent course.
Enable WordPress request logging and search for authenticated admin-ajax.php or REST calls to Tutor LMS Q&A actions with varying thread IDs from one session.
Correlate WordPress user role data with course enrollment metadata to identify cross-course Q&A activity by subscribers.

Monitoring Recommendations

Alert on subscriber accounts accessing Q&A endpoints across more than one course within a session.
Monitor for spikes in Q&A read or write requests following new subscriber registration.
Track outbound content in Q&A replies for spam, phishing links, or social engineering payloads injected by unauthorized users.

How to Mitigate CVE-2026-14310

Immediate Actions Required

Upgrade the Tutor LMS plugin to version 4.0.0 or later on every WordPress site where it is installed.
Audit existing Q&A threads for replies posted by users who are not enrolled in the corresponding course and remove unauthorized content.
Review the subscriber user list and disable or delete accounts that show suspicious cross-course activity.

Patch Information

The vendor has addressed the issue in Tutor LMS version 4.0.0. The fix adds course-level access validation to Q&A read and write handlers. Administrators should apply the update through the WordPress plugin dashboard or by deploying the updated plugin package. See the WPScan Vulnerability Reference for advisory details.

Workarounds

Restrict new user registration on affected WordPress sites until the plugin is updated.
Temporarily disable the Q&A feature within Tutor LMS course settings if patching cannot be applied immediately.
Place the WordPress admin and AJAX endpoints behind a web application firewall rule that blocks Tutor LMS Q&A actions from subscriber-role sessions.

bash

# Update Tutor LMS via WP-CLI to remediate CVE-2026-14310
wp plugin update tutor --version=4.0.0
wp plugin list --name=tutor --fields=name,status,version