CVE-2026-14310

Authenticated users with elevated privileges in Tutor LMS WordPress plugin versions prior to 4.0.0 can exploit a permissions oversight, enabling them to view and manipulate question-and-answer threads from unrelated courses. This vulnerability stems from inadequate access controls, allowing subscribers and higher-privileged users to access and alter Q&A content outside their own courses.

Based on public CVE data (MITRE/NVD).