CVE-2026-14187
Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
| Vendor | unknown |
| Product | tutor lms |
| Published | Aug 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown tutor lms
Be the first to know when new unknown vulnerabilities affecting unknown tutor lms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Tutor LMS
0 < 4.0.6
References
Credits
Mustafa Ahmed WPScan