🔐 CVE Alert

CVE-2026-0548

MEDIUM 5.4

Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion

CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.

CWE CWE-862
Vendor themeum
Product tutor lms – elearning and online course solution
Published Jan 20, 2026
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for themeum tutor lms – elearning and online course solution

Be the first to know when new medium vulnerabilities affecting themeum tutor lms – elearning and online course solution are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

themeum / Tutor LMS – eLearning and online course solution
0 ≤ 3.9.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?old_path=/tutor/tags/3.9.4/classes/User.php&new_path=/tutor/tags/3.9.5/classes/User.php

Credits

M Indra Purnama