Platform
wordpress
Component
tutor
Fixed in
3.9.9
3.9.9
CVE-2026-5502 is a security vulnerability affecting the Tutor LMS plugin for WordPress. This issue allows unauthorized users to manipulate course content due to a missing authorization check within the plugin's code. Versions of Tutor LMS up to and including 3.9.8 are affected, and a patch is available in version 3.9.9.
Exploit Status
EPSS
0.01% (3% percentile)
CISA SSVC
CVSS Vector
Update to version 3.9.9, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-5502 is a vulnerability in the Tutor LMS WordPress plugin that allows unauthorized users to modify course content. It’s caused by a missing authorization check, allowing manipulation if the 'content_parent' parameter is absent in the request.
You are potentially affected if you are using Tutor LMS version 3.9.8 or earlier. It’s crucial to assess your plugin versions and apply the necessary updates to mitigate this risk.
The vulnerability is fixed in Tutor LMS version 3.9.9. Update your plugin to this version or later to address the issue and prevent unauthorized course content manipulation.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.