CVE-2026-14306 in Tutor LMS Plugin

Sumário

de MITRE • 07/08/2026

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsável: WPScan
• Reservar: 01/07/2026
• Divulgação: 07/08/2026
• Moderação: aceite
• Entrada: VDB-386726
• CPE: pronto
• CWE: CWE-639 (confirmado)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-14306
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14306
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-14306/