CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
| Vendor | unknown |
| Product | tutor lms |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown tutor lms
Be the first to know when new unknown vulnerabilities affecting unknown tutor lms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Tutor LMS
0 < 4.1.1
References
Credits
Kevin Chen WPScan