PT-2026-32084 · WordPress · Tutor Lms

Published 2026-04-11 · Updated 2026-04-11 · CVE-2026-3358

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to and including 3.9.7

Description The Tutor LMS plugin for WordPress is susceptible to unauthorized enrollment in private courses. This occurs because the enroll now() and course enrollment() functions do not validate the post status of a course, specifically whether it is marked as private. An authenticated attacker with Subscriber-level access or higher can enroll in a private course by sending a crafted POST request containing the course ID. While WordPress access control prevents viewing the course content, the course title and enrollment status are visible in the subscriber's dashboard.

Recommendations Update Tutor LMS to a version later than 3.9.7.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3358

Affected Products

Tutor Lms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3358 · Security Note
• https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/classes/Course.php · Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L2066 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ftutor/tags/3.9.8 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0c173356-7228-4253-bb28-2c2e11af76fd?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2042820365848637696 · Twitter Post
• https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L2053 · Note
• https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L2989 · Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L134 · Note