VULNERABILITY INTELLIGENCE

CVE-2026-14187

CVSS score2.7 LOW

EPSS probability0.30%

CISA KEVNot currently listed

Published2026-08-22

Last modified2026-10-12

Description

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.