CVE-2026-14187

The Tutor LMS WordPress plugin prior to version 4.0.6 is vulnerable due to a lack of per-object ownership checks, enabling users with the instructor role to access private course content created by other instructors. This flaw poses a significant risk of unauthorized information exposure, potentially compromising the privacy of course materials. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this security risk.