CVE-2026-85572 in Tutor LMS Plugin
Summary
by MITRE • 09/16/2026
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Tutor LMS WordPress plugin prior to version 4.0.8 represents a critical failure in access control mechanisms within an educational content management system. This flaw specifically affects the handling of lesson discussion threads, which are intended to be restricted exclusively to users who have formally enrolled in and paid for specific courses. The core technical deficiency lies in the absence of proper authorization checks when retrieving comment data associated with course lessons. Instead of verifying that the requesting user possesses valid enrollment status or appropriate permissions for the targeted course ID, the application logic directly queries the database and returns discussion content based solely on the provided identifier. This oversight allows any authenticated user, regardless of their role such as a subscriber or student without active enrollment in the specific course, to access sensitive communication threads intended only for enrolled participants.
From an operational perspective, this vulnerability facilitates unauthorized information disclosure by exposing private discussions between instructors and students who are part of the class cohort. The impact extends beyond simple privacy violations; it includes exposure of comments that are currently awaiting moderation. These pending comments often contain unvetted user-generated content which may include personal identifiable information, sensitive academic feedback, or other confidential data not yet cleared for public view. Attackers can exploit this by crafting specific HTTP requests to the plugin's API endpoints with varying course identifiers, systematically enumerating and extracting discussion threads from courses they have no legitimate business accessing. This capability undermines the integrity of the learning environment and breaches the confidentiality expectations inherent in paid educational platforms where discussions are often treated as private community spaces rather than public forums.
The technical classification of this issue aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user permissions before granting access to resources. Furthermore, within the context of cyber threat modeling and adversary behavior simulation using the MITRE ATT&CK framework, this vulnerability maps directly to T1078 Valid Accounts, as it requires authentication but exploits weak authorization logic rather than credential theft. It also relates to T1530 Data from Information Repositories, where an attacker exfiltrates data stored within a system by exploiting misconfigured access controls. The severity is heightened because the vulnerability does not require complex exploitation techniques or privilege escalation; it relies on basic HTTP request manipulation that can be performed with minimal effort using standard web tools or automated scripts once valid credentials are obtained through any means, including phishing or credential stuffing attacks against less secure user accounts.
Mitigation strategies must prioritize immediate patching to version 4.0.8 or later, where the developers have implemented rigorous server-side validation of enrollment status before rendering discussion content. In environments where upgrading is not immediately feasible, administrators should implement web application firewall rules that monitor for anomalous patterns in API requests targeting lesson comment endpoints, particularly those lacking valid session tokens associated with course enrollments. Additionally, conducting a thorough audit of other plugin functions to ensure consistent enforcement of role-based access control across all user-facing features is essential to prevent similar bypasses in different modules. Regular security testing and code reviews focusing on authorization logic are recommended to maintain the confidentiality and integrity of sensitive educational data within WordPress ecosystems.