CVE-2026-14306CWE-639

CVE-2026-14306

Medium · published August 7, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-07T02:16Z
References (1)
https://wpscan.com/vulnerability/0da44ad7-a5a7-4559-b2ae-3b7f0b0ce1bf/ · [email protected]
EPSS history
Timeline
  • 06 AUG 16:49Z
    Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
    cvelistv5