PT-2026-6042 · WordPress · Tutor Lms

Supakiad S · Published 2026-02-03 · Updated 2026-02-03 · CVE-2026-1371

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.6

Description The Tutor LMS plugin for WordPress has a flaw where sensitive coupon details can be accessed without proper authorization. The issue stems from insufficient validation within the ajax coupon details() function, which only checks for nonces but does not confirm user permissions. This allows users with Subscriber-level access or higher to obtain confidential information about coupons, including coupon codes, discount amounts, usage data, and course/bundle associations.

Recommendations Update Tutor LMS to version 3.9.6 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1371

Affected Products

Tutor Lms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1371 · Security Note
• https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/ecommerce/CouponController.php?contextall=1&old=3422766&old_path=%2Ftutor%2Ftrunk%2Fecommerce%2FCouponController.php · Note
• https://t.me/cveNotify/150698 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2018701855736439130 · Twitter Post
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L106 · Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L658 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=cve · Note
• https://t.me/CVEtracker/43583 · Telegram Post