Home

Description

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

PUBLISHED Reserved 2026-01-14 | Published 2026-03-10 | Updated 2026-03-10 | Assigner Wordfence




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-287 Improper Authentication

Product status

Default status
unaffected

* (semver)
affected

Timeline

2026-01-14:Vendor Notified
2026-03-09:Disclosed

Credits

Nguyen Tan Phat finder

References

www.wordfence.com/...-66ae-4678-a87a-e62da885d50b?source=cve

tutorlms.com/releases/id/393/

cve.org (CVE-2026-0953)

nvd.nist.gov (CVE-2026-0953)

Download JSON