PT-2026-6042 · WordPress · Tutor Lms

Supakiad S · Publicado 2026-02-03 · Atualizado 2026-02-03 · CVE-2026-1371

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.6

Description The Tutor LMS plugin for WordPress has a flaw where sensitive coupon details can be accessed without proper authorization. The issue stems from insufficient validation within the ajax coupon details() function, which only checks for nonces but does not confirm user permissions. This allows users with Subscriber-level access or higher to obtain confidential information about coupons, including coupon codes, discount amounts, usage data, and course/bundle associations.

Recommendations Update Tutor LMS to version 3.9.6 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-1371

Produtos afetados

Tutor Lms

Referências · 8

• https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/ecommerce/CouponController.php?contextall=1&old=3422766&old_path=%2Ftutor%2Ftrunk%2Fecommerce%2FCouponController.php · Nota
• https://t.me/cveNotify/150698 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1371 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2018701855736439130 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L106 · Nota
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L658 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=cve · Nota
• https://t.me/CVEtracker/43583 · Publicação no Telegram