{
 "id": "WPSEC-2026-2831",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2831/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2831/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2831/index.md",
 "title": "Tutor LMS <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Lesson, Quiz and Assignment Archives and Feeds",
 "description": "The Tutor LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via lesson, quiz and assignment post type archives and feeds in all versions up to, and including, 4.2.0. This is due to these enrollment-protected post types being registered as public with archives enabled, while the enrollment check is only applied in the single-post template, so their content was not restricted in archive, feed or other listing contexts. This makes it possible for unauthenticated attackers to read the content of enrollment-protected lessons, quizzes and assignments through post type archives and RSS feeds.",
 "plugin": {
  "slug": "tutor",
  "name": "Tutor LMS",
  "full_name": "Tutor LMS – eLearning and online course solution",
  "wordpress_org": "https://wordpress.org/plugins/tutor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tutor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tutor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.1",
 "remediation": "Update to 4.2.1 or later.",
 "fix_released": "2026-11-09T21:34:13+00:00",
 "published": "2026-11-10T21:42:30+00:00",
 "updated": "2026-11-10T00:16:10.936789+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2831/",
  "https://plugins.svn.wordpress.org/tutor/tags/4.2.1/",
  "https://wordpress.org/plugins/tutor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tutor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}