Tutor LMS <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Lesson, Quiz and Assignment Archives and Feeds
- ID
- WPSEC-2026-2831
- Plugin
- Tutor LMS – eLearning and online course solution (tutor)
- Affected
- all versions before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Tutor LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Tutor LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via lesson, quiz and assignment post type archives and feeds in all versions up to, and including, 4.2.0. This is due to these enrollment-protected post types being registered as public with archives enabled, while the enrollment check is only applied in the single-post template, so their content was not restricted in archive, feed or other listing contexts. This makes it possible for unauthenticated attackers to read the content of enrollment-protected lessons, quizzes and assignments through post type archives and RSS feeds.
References
- https://wpsec.com/vuln/WPSEC-2026-2831/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS