CVE-2026-96537 — Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish…
Published: 2026-10-15 · CVSS: 7.5 · CVSS 3.1
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7