CVE-2026-3358 Details
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.
A vulnerability exists in the Tutor LMS WordPress plugin, allowing unauthorized enrollment in private courses. This issue affects all versions up to and including 3.9.7. The vulnerability arises from a lack of validation for the post status in the 'enroll_now()' and 'course_enrollment()' functions. While these functions check the nonce, user authentication, and course purchasability, they neglect to verify if a course is marked as private. As a result, authenticated users with Subscriber-level access or higher can enroll in private courses by sending a crafted POST request with the course ID. Although the enrollment is recorded in the database and the course title and enrollment status are visible in the subscriber's dashboard, WordPress's core access controls prevent subscribers from accessing the actual course content, which results in a 404 error. Enrollment in private courses should be limited to users with the 'read_private_posts' capability.
Users are advised to update the Tutor LMS WordPress plugin to version 3.9.8 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 11, 2026CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tutor LMS | <= 3.9.7 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 11, 2026 | New CVE Received | [email protected] |