CVE-2026-14310: Authorization Bypass Through User-Controlled Key

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-15444

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

EUVD-2026-49762

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-15444

The CVE affects the Tutor LMS WordPress plugin up to version 4.0.1. It is vulnerable to a generic SQL Injection in the coupon_code parameter due to insufficient escaping and an inadequately prepared SQL query. Exploitation requires authenticated access at administrator level or higher, enabling a...

CVE-2026-15444

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-15444: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

PT-2026-65448

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.1 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tutor LMS versions = 4.0.1...

CVE-2026-1372

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

EUVD-2026-46167

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The CVE concerns the WordPress plugins Tutor LMS Elementor Addons (

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372: Missing Authorization

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

PT-2026-61844

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activate tutor free and activate elementor free functions registered as admin action handlers. This makes it...

WordPress Tutor LMS Elementor Addons plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor plugin Activation vulnerability

Missing Authorization to Authenticated Subscriber+ Tutor LMS and Elementor plugin Activation vulnerability discovered by ? in WordPress Plugin Tutor LMS Elementor Addons versions = 4.0.0...

CVE-2026-15022

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...