CVE-2026-0953CWE-287

Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login

Critical · published March 10, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00667 · 51.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-03-10T05:26Z
EPSS history
Timeline
  • 10 MAR 05:26Z
    Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
    cvelistv5