Is CVE-2026-85572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85572 being exploited in the wild.

How severe is CVE-2026-85572?

Medium severity, with a CVSS score of 4.3, published 16 September 2026.

Which products and versions are affected?

Tutor Tutor LMS 4.0.0 to 4.0.7.

Is there a fix for CVE-2026-85572?

A patch was published on 2026-09-16: Fixed in version 4.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85572 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85572?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85572: Tutor LMS improper access control in lesson discussion content

CVE-2026-85572 · Severity: medium · CVSS 4.3 · Published 2026-09-16

Tutor LMS is a popular WordPress LMS (learning management system) plugin used to deliver online courses. The plugin fails to verify course enrollment before displaying lesson discussion comments, allowing any logged-in user to read comments from courses they do not have access to—including moderation-pending comments. This breaks course access controls and exposes sensitive discussion content.

Quick answers

Is CVE-2026-85572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85572 being exploited in the wild.
How severe is CVE-2026-85572?: Medium severity, with a CVSS score of 4.3, published 16 September 2026.
Which products and versions are affected?: Tutor Tutor LMS 4.0.0 to 4.0.7.
Is there a fix for CVE-2026-85572?: A patch was published on 2026-09-16: Fixed in version 4.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85572 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85572?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw (CWE-200, OWASP A3) in the lesson discussion content endpoint. The plugin does not validate that the authenticated user is enrolled in or has permission to access a specific course before returning its lesson comments. An attacker with any valid WordPress account (subscriber or higher) can bypass enrollment checks via direct API requests or page access, retrieving lesson discussion content and comments pending moderation. The vulnerability affects versions 4.0.0 through 4.0.7; a patch was released in version 4.0.8.

Affected products

Tutor Tutor LMS 4.0.0 to 4.0.7

Timeline

2026-09-14: disclosed
2026-09-16: patched: Fixed in version 4.0.8

References

https://wpscan.com/vulnerability/a02f2c69-69cf-46fa-b4cf-0cf990d71e57/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.