CVE-2026-96537 Overview
CVE-2026-96537 is a missing authorization vulnerability [CWE-862] in the Tutor LMS WordPress plugin versions prior to 4.1.1. The plugin fails to perform a capability check in a routine that regenerates its managed pages. Unauthenticated attackers can force-publish unpublished pages, overwrite existing page content, create missing pages, and modify options that reference them. The flaw affects content integrity on any WordPress site running a vulnerable version of Tutor LMS.
Critical Impact
Unauthenticated remote attackers can tamper with WordPress pages managed by Tutor LMS, overwriting content and manipulating plugin page references without any user interaction.
Affected Products
- Tutor LMS WordPress plugin versions prior to 4.1.1
- WordPress sites with Tutor LMS installed and activated
- Any hosting environment exposing the plugin's AJAX or REST endpoints to the public internet
Discovery Timeline
- 2026-10-15 - CVE-2026-96537 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-96537
Vulnerability Analysis
The vulnerability resides in a Tutor LMS routine responsible for regenerating the plugin's managed WordPress pages. These pages typically host course listings, student dashboards, and checkout flows. The regeneration routine executes privileged write operations against the WordPress posts table and the wp_options store without verifying the caller's capabilities.
Because the handler is reachable without authentication, any unauthenticated HTTP client can trigger it. Successful exploitation lets an attacker publish draft pages, overwrite the content of existing pages, create new pages, and change plugin options that point to those pages. The impact is scoped to integrity, which aligns with the CWE-862 classification for Missing Authorization.
Root Cause
The root cause is the absence of a current_user_can() capability check and a corresponding nonce verification inside the page regeneration handler. The function trusts request input and performs state-changing operations on behalf of any caller. See the WPScan Vulnerability Report for the technical breakdown.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by Tutor LMS. The server executes the regeneration routine, which forcibly publishes targeted pages, overwrites their content with plugin-generated markup, and rewrites option values that reference them. No authentication, no privileges, and no user interaction are required.
// No verified proof-of-concept code is available.
// Refer to the WPScan advisory for technical details:
// https://wpscan.com/vulnerability/e25ac9a8-a29d-4573-9d04-402a14515fb7/
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-96537
Indicators of Compromise
- Unexpected transitions of WordPress pages from draft or pending status to publish without a corresponding administrator action in the audit log.
- Overwritten content on pages previously managed by Tutor LMS, with the page body replaced by default plugin shortcodes.
- Modifications to wp_options rows whose keys reference Tutor LMS page identifiers, such as course list, dashboard, or checkout page options.
- Anonymous POST requests in web server logs targeting Tutor LMS AJAX or REST endpoints from unfamiliar source IPs.
Detection Strategies
- Compare current WordPress page content and post_status values against known-good backups to identify unauthorized changes.
- Monitor the wp_posts and wp_options tables for writes originating from unauthenticated sessions.
- Alert on admin-ajax.php and wp-json requests that invoke Tutor LMS actions without a valid authenticated session cookie.
Monitoring Recommendations
- Enable WordPress audit logging to record page publish events, content revisions, and option updates with associated user context.
- Forward web server access logs and WordPress audit events to a centralized SIEM for correlation across sites.
- Baseline normal request rates to Tutor LMS endpoints and alert on sudden spikes from single source addresses.
How to Mitigate CVE-2026-96537
Immediate Actions Required
- Upgrade the Tutor LMS plugin to version 4.1.1 or later on every affected WordPress site.
- Audit all pages managed by Tutor LMS and restore any content that was overwritten or force-published.
- Review wp_options entries referencing Tutor LMS pages and reset any values changed by unauthorized requests.
- Rotate administrator credentials if post-incident analysis reveals follow-on account activity.
Patch Information
The vendor fixed the issue in Tutor LMS 4.1.1 by adding the missing capability check to the page regeneration routine. Site operators should install the update through the WordPress plugin manager or deploy it via their configuration management pipeline. Full technical details are available in the WPScan Vulnerability Report.
Workarounds
- Block unauthenticated requests to Tutor LMS AJAX and REST endpoints at the web application firewall until the patch is applied.
- Temporarily deactivate the Tutor LMS plugin on sites that cannot be updated immediately.
- Restrict access to /wp-admin/admin-ajax.php and /wp-json/tutor/ paths to known administrator IP ranges where feasible.
# Example WAF rule blocking anonymous access to Tutor LMS REST endpoints
# (adapt to your WAF syntax before deploying)
SecRule REQUEST_URI "@beginsWith /wp-json/tutor/" \
"id:1026965370,phase:1,deny,status:403,\
chain,msg:'Block unauthenticated Tutor LMS access (CVE-2026-96537)'"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
