{"id":"CVE-2026-85572","aliases":["EUVD-2026-80198","GHSA-9w2v-rcqp-f469"],"status":"published","title":"Tutor LMS 4.0.0 - \u003c 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure","description":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00295,"percentile":0.22261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-09-16T06:00:14Z","modified":"2026-09-17T15:32:07Z","products":[{"vendor":"themeum","product":"tutor lms"},{"vendor":"unknown","product":"tutor lms"}],"references":[{"url":"https://wpscan.com/vulnerability/a02f2c69-69cf-46fa-b4cf-0cf990d71e57/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85572"},{"url":"https://wpscan.com/vulnerability/a02f2c69-69cf-46fa-b4cf-0cf990d71e57"},{"url":"https://github.com/advisories/GHSA-9w2v-rcqp-f469"}],"sources":{"cve":[{"id":"CVE-2026-85572","title":"Tutor LMS 4.0.0 - \u003c 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure","description":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.","status":"published","published":"2026-09-16T06:00:14.648Z","modified":"2026-09-17T12:35:44.379Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-80198","description":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.","status":"published","published":"2026-09-16T06:00:14Z","modified":"2026-09-17T12:35:44Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:13.171257Z"}],"ghsa":[{"id":"GHSA-9w2v-rcqp-f469","title":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course...","description":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.","status":"published","published":"2026-09-16T06:31:35Z","modified":"2026-09-17T15:32:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:04.687174Z"}],"nvd":[{"id":"CVE-2026-85572","description":"The Tutor LMS  WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.","status":"published","published":"2026-09-16T06:16:34.31Z","modified":"2026-09-17T13:16:51.287Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:48.287983Z"}]}}