CVE-2026-14310

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.0

Description The plugin fails to properly verify if a user has access to the course associated with a Q&A thread before returning or writing to that thread. This is caused by a missing capability check in a function, allowing authenticated users with subscriber-level access and above who can access any single course to read Q&A threads of other courses and inject replies into them.

Recommendations Update to version 4.0.0 or later.