CVE-2026-85572 Overview
CVE-2026-85572 is an information disclosure vulnerability in the Tutor LMS WordPress plugin versions before 4.0.8. The plugin fails to verify course enrollment before returning lesson discussion content. Any authenticated user, including a low-privileged subscriber, can read comments from courses they are not enrolled in. Exposed content includes comments awaiting moderation, which may contain sensitive student or instructor communications.
The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Authenticated subscribers can read private lesson discussions and unmoderated comments across all courses hosted on the affected WordPress instance.
Affected Products
- Tutor LMS WordPress plugin versions prior to 4.0.8
- WordPress sites offering paid or restricted courses via Tutor LMS
- Learning platforms relying on Tutor LMS enrollment-based content gating
Discovery Timeline
- 2026-09-16 - CVE-2026-85572 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-85572
Vulnerability Analysis
The Tutor LMS plugin exposes lesson discussion content through an authenticated endpoint that does not enforce course-level access checks. When a logged-in user requests lesson comments, the plugin returns the comment payload based solely on the authenticated session, ignoring whether the user is enrolled in the target course. This breaks the enrollment gate that separates paying students from general site subscribers.
The returned data includes comments in a pending moderation state. Instructor replies, student questions, and content flagged for review become readable by any account on the site. On WordPress installations where user registration is open, attackers can self-register and harvest content across the entire course catalog.
Root Cause
The root cause is a missing authorization check on the lesson discussion retrieval handler. The plugin authenticates the request but does not call an enrollment verification function before returning comment data. This is a broken access control pattern where authentication is conflated with authorization.
Attack Vector
Exploitation requires only a valid low-privilege account, such as a subscriber. The attacker sends a request to the vulnerable endpoint referencing a lesson identifier from a course they are not enrolled in. The server returns the comment thread, including unpublished entries. The vulnerability is network-exploitable and requires no user interaction from the victim.
Refer to the WPScan Vulnerability Report for the technical writeup.
Detection Methods for CVE-2026-85572
Indicators of Compromise
- Requests to Tutor LMS AJAX or REST endpoints returning lesson comment data from subscriber-level accounts.
- Repeated enumeration of sequential lesson or course identifiers from a single authenticated session.
- Sudden spikes in authenticated API calls originating from newly registered accounts.
Detection Strategies
- Review WordPress access logs for authenticated requests to Tutor LMS discussion endpoints paired with lesson IDs the requesting user is not enrolled in.
- Cross-reference enrollment records with comment retrieval activity to identify unauthorized reads.
- Alert on subscriber accounts issuing high volumes of AJAX requests to admin-ajax.php with Tutor LMS action parameters.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and admin-ajax.php handlers.
- Monitor creation of new subscriber accounts followed by immediate access to course content endpoints.
- Track outbound data volume from Tutor LMS endpoints to detect bulk comment scraping.
How to Mitigate CVE-2026-85572
Immediate Actions Required
- Update the Tutor LMS plugin to version 4.0.8 or later on all affected WordPress sites.
- Audit existing subscriber accounts and remove any that were created without a legitimate enrollment purpose.
- Review pending and previously moderated comments for sensitive information that may have been exposed.
Patch Information
The vendor addressed the missing access control in Tutor LMS version 4.0.8. The patched release adds an enrollment verification step to the lesson discussion retrieval logic. Site administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package manually.
Workarounds
- Disable open user registration in WordPress settings to reduce the pool of accounts that can exploit the flaw.
- Restrict access to the Tutor LMS discussion endpoints using a web application firewall rule until the patch is applied.
- Temporarily disable the lesson discussion feature in Tutor LMS settings if patching cannot be performed immediately.
# Update Tutor LMS via WP-CLI to the patched version
wp plugin update tutor --version=4.0.8
# Verify installed version
wp plugin get tutor --field=version
# Optionally disable open registration until patched
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
