Security Alert Summary
The Tutor LMS WordPress plugin contains a vulnerability that fails to perform a capability check in a page-regeneration routine. This can allow unauthenticated users to force-publish unpublished pages, overwrite page content, create missing pages, and modify the options that reference them in affected versions prior to 4.1.1.
CVE Details
- CVE ID:
CVE-2026-96537 - Affected component: Tutor LMS WordPress plugin
- Affected versions: Versions before 4.1.1 (as stated in the description)
- Published: October 15, 2026 at 7:18:03 AM UTC
- Last modified: October 15, 2026 at 2:47:05 PM UTC
- CVSS v3.1 base score: 7.5
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Authentication / privileges / user interaction:
- Authentication required: None
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: None
- Integrity: High (unauthorized modification or publishing of page content)
- Availability: None
- Weakness (CWE): CWE-862
Technical Details
According to the CVE description, the plugin does not perform a capability check inside a routine that regenerates its managed pages. Because the routine lacks proper authorization checks, unauthenticated users can trigger the regeneration process and cause the following actions:
- Force-publish pages that were previously unpublished.
- Overwrite the content of existing managed pages.
- Create missing managed pages.
- Modify plugin options that reference those pages.
The issue exists because the routine that handles page regeneration does not verify the caller’s capabilities before performing page and option updates. The impact is limited to modification and publishing of managed pages and related options; the CVSS data indicates no direct confidentiality or availability impact.
How This Could Impact Your Website
In a realistic scenario, a site owner maintains a Tutor LMS site while internal staff and external contributors add or edit course content. An unauthenticated actor could trigger the vulnerable regeneration routine and cause managed pages to be published or overwritten. Practical consequences include:
- Unauthorised publication or alteration of course pages or other managed content, which can confuse users and damage trust.
- Changes to options that reference pages, potentially breaking expected links or navigation and causing operational issues for internal staff managing courses.
- Increased risk of targeted social engineering: modified pages could be used to present misleading content or links that facilitate phishing or other deception, even though the CVSS data indicates confidentiality impact as none.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access and any accounts that can be used to modify content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and content changes for unusual behavior, including unexpected page publications or option changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
