CVE-2026-85571

6.5 Moyenne

Publiée le 10/10/2026 à 08:16 · Modifiée le 13/10/2026 à 22:36 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

Traduire en français

Produits concernés

Unknown Tutor LMS

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/3c4ce27a-527a-416f-b1c8-d40ca5f65974/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories