CVE-2026-96537 in Tutor LMS Plugin

Sumário

de MITRE • 15/10/2026

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsável: WPScan
• Reservar: 23/09/2026
• Divulgação: 15/10/2026
• Moderação: aceite
• Entrada: VDB-420490
• CPE: 20261015
• CWE: CWE-862 (confirmado)
• CVSS: 6.5 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-96537
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96537
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-96537/