cve-2026-0953
HIGH vulncheck_kev
Description
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.
Timeline
- Published
- 2026-03-09 00:00 UTC
- Last Modified
- 2026-03-09
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 0.0,
"datePublished": "2026-03-09T00:00:00Z",
"dateUpdated": "2026-03-09T00:00:00Z",
"description": "The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.",
"dueDate": "",
"id": "CVE-2026-0953",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "Tutor LMS Pro",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "HIGH",
"source": "vulncheck_kev",
"title": "Themeum tutor_lms Improper Authentication",
"vendor": "Themeum"
}