CVE-2026-14310

The CVE concerns Tutor LMS for WordPress, affecting versions before 4.0.0. The underlying issue is improper access verification for Q&A threads: an authenticated user with subscriber-level access (or higher) who can access any single course can read Q&A threads in other courses and inject replies...