CVE-2026-14187 — Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the cont…
Published: 2026-08-22 · CVSS: 2.7 · CVSS 3.1
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7