Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Tutor LMS 4.0.6 Clear all filters
TI-2026-15609 CVE-2026-19093 · GHSA-m8r7-xfwf-2vw8

Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

Priority LOW 30

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00459 Published 2026-08-22 Fixed in 4.0.6 CWE-552
TI-2026-12018 CVE-2026-14187 · GHSA-6c7v-vhfc-h7pv

Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR

Priority LOW 13

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other in…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00299 Published 2026-08-22 Fixed in 4.0.6 CWE-639