CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated user—even a subscriber role—to read comments from courses they are not enrolled in, including comments awaiting ...