# Tutor LMS <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Lesson, Quiz and Assignment Archives and Feeds

- **ID:** WPSEC-2026-2831
- **Plugin:** Tutor LMS – eLearning and online course solution (`tutor`), https://wordpress.org/plugins/tutor/
- **Affected versions:** all versions before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tutor
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2831/

## Description

The Tutor LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via lesson, quiz and assignment post type archives and feeds in all versions up to, and including, 4.2.0. This is due to these enrollment-protected post types being registered as public with archives enabled, while the enrollment check is only applied in the single-post template, so their content was not restricted in archive, feed or other listing contexts. This makes it possible for unauthenticated attackers to read the content of enrollment-protected lessons, quizzes and assignments through post type archives and RSS feeds.

## References

- https://wpsec.com/vuln/WPSEC-2026-2831/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2831/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.