CVE-2026-96537CWE-862broken-access-control

CVE-2026-96537

High · published October 15, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-15T11:18Z
References (1)
https://wpscan.com/vulnerability/e25ac9a8-a29d-4573-9d04-402a14515fb7/ · [email protected]
EPSS history
Timeline
  • 16 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 15 OCT 06:00Z
    Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
    cvelistv5
  • 15 OCT 06:00Z
    Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
    cvelistv5