Vulnerabilities CVE-2026-14306

CVE-2026-14306

Medium

Open

TLP:CLEAR

Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Details

CVSS Score: 4.3
EPSS Score ⓘ: 0.20%

9.8th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.