CVE-2026-85572

The Tutor LMS WordPress plugin (versions 4.0.0–4.0.7 ) contains an insufficient access control flaw: lesson discussion content (comments) is returned without verifying that the requesting user is enrolled in the course. Any authenticated user (subscriber or higher) can therefore read comments—inc...