# Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action

- **ID:** WPSEC-2026-0518
- **Plugin:** Tutor LMS – eLearning and online course solution (`tutor`), https://wordpress.org/plugins/tutor/
- **Affected versions:** from 1.4.3 before 4.1.1
- **Fixed in:** 4.1.1 (Update to 4.1.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tutor
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0518/

## Description

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the regenerate_tutor_pages() function in versions 1.4.3 to 4.1.0. The function was triggered by the 'tutor_action' request parameter on every request and was protected only by a nonce that the plugin prints on public pages for all visitors. This makes it possible for unauthenticated attackers to make the plugin publish its required pages (dashboard, registration, cart and checkout) when they are missing or unpublished. This overwrites the content of an unpublished page the settings point to, and changes the plugin's page settings.

## References

- https://wpsec.com/vuln/WPSEC-2026-0518/
- https://plugins.svn.wordpress.org/tutor/tags/4.1.1/
- https://wordpress.org/plugins/tutor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0518/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.