Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action
- ID
- WPSEC-2026-0518
- Plugin
- Tutor LMS – eLearning and online course solution (tutor)
- Affected
- from 1.4.3 before 4.1.1
- Remediation
- Update to 4.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-07
- Attack surface
- Tutor LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the regenerate_tutor_pages() function in versions 1.4.3 to 4.1.0. The function was triggered by the 'tutor_action' request parameter on every request and was protected only by a nonce that the plugin prints on public pages for all visitors. This makes it possible for unauthenticated attackers to make the plugin publish its required pages (dashboard, registration, cart and checkout) when they are missing or unpublished. This overwrites the content of an unpublished page the settings point to, and changes the plugin's page settings.
References
- https://wpsec.com/vuln/WPSEC-2026-0518/
- https://plugins.svn.wordpress.org/tutor/tags/4.1.1/
- https://wordpress.org/plugins/tutor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS