CVE-2026-0953: Authentication Bypass in Tutor LMS Pro

The impact of this vulnerability is severe. An attacker can leverage a valid OAuth token from their own account, combined with a victim's email address, to bypass authentication and log in as that user. This grants them full access to the victim's account, including the ability to modify course content, student data, and plugin settings. For administrator accounts, the attacker could completely compromise the WordPress site, leading to data breaches, malware installation, or website defacement. The ease of exploitation, requiring only a valid OAuth token and email address, significantly increases the risk of widespread attacks.

1. Reserved2026-01-14
2. Published2026-03-10
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Tutor LMS Pro plugin to version 3.9.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the Social Login addon to prevent exploitation. Review WordPress user accounts for any suspicious activity. Implement stricter OAuth application permissions to limit the scope of tokens issued. Monitor WordPress access logs for unusual login attempts, particularly those involving OAuth providers. After upgrading, confirm the fix by attempting a login with a different email address using a valid OAuth token – the login should be denied.