{
 "id": "WPSEC-2026-0518",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0518/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0518/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0518/index.md",
 "title": "Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action",
 "description": "The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the regenerate_tutor_pages() function in versions 1.4.3 to 4.1.0. The function was triggered by the 'tutor_action' request parameter on every request and was protected only by a nonce that the plugin prints on public pages for all visitors. This makes it possible for unauthenticated attackers to make the plugin publish its required pages (dashboard, registration, cart and checkout) when they are missing or unpublished. This overwrites the content of an unpublished page the settings point to, and changes the plugin's page settings.",
 "plugin": {
  "slug": "tutor",
  "name": "Tutor LMS",
  "full_name": "Tutor LMS – eLearning and online course solution",
  "wordpress_org": "https://wordpress.org/plugins/tutor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tutor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tutor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.4.3",
    "from_inclusive": true,
    "to": "4.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.4.3 before 4.1.1"
  ]
 },
 "introduced_in": "1.4.3",
 "fixed_in": "4.1.1",
 "remediation": "Update to 4.1.1 or later.",
 "fix_released": "2026-10-06T11:07:46+00:00",
 "published": "2026-10-07T11:46:41+00:00",
 "updated": "2026-10-06T14:18:51.926593+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0518/",
  "https://plugins.svn.wordpress.org/tutor/tags/4.1.1/",
  "https://wordpress.org/plugins/tutor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tutor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-07"
 }
}