CVE-2026-85571EPSS p13.1%

CVE-2026-85571CVE-2026-85571

Description

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

Scoring

CVSS 6.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS0.23% probability of exploitation · percentile 13.1% · 2026-10-15T12:03:56Z
Last modified2026-10-13
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.