CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
Published Oct 15, 2026 · updated Oct 15, 2026 · Unknown Tutor LMS
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Oct 15, 2026 · NIST NVD
Updated
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Oct 15, 2026 · NIST NVD
Updated
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Affected
- vendor Unknown Tutor LMSversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-96537
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that referen
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-96537
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that referen
cve.org - FIRST EPSSExploitation probabilityCVE-2026-96537
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-96537
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that refere
nvd.nist.gov