CVE-2026-88944

CVE-2026-88944 is an authorization bypass in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8 ). The plugin fails to properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access or above to permanently delete a...

WordPress Tutor LMS plugin <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion via 'lessonid' Parameter vulnerability discovered by EUNHO KIM - Hyundai Autoever in WordPress Plugin Tutor LMS versions = 4.0.8...