Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Tutor LMS 4.0.8 Clear all filters
TI-2026-58697 CVE-2026-85572 · GHSA-9w2v-rcqp-f469

Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

Priority LOW 20

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from c…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-09-16 Fixed in 4.0.8 CWE-200
TI-2026-58696 CVE-2026-85569 · GHSA-55mc-729g-3x85

Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

Priority LOW 34

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-09-16 Fixed in 4.0.8 CWE-269