CVE-2026-0953 | The Tutor LMS Pro plugin for WordPress is vulnerable to auth… | CVSS 9.8 CRITICAL

Description

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

Metadata

CVE ID: CVE-2026-0953
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-01-14 19:02 UTC
Published: 2026-03-10 05:26 UTC
Last updated: 2026-04-08 17:09 UTC
Primary CWE: CWE-287
CWE-287 Improper Authentication
Vendor / Product: themeum / Tutor LMS Pro
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
themeum	Tutor LMS Pro	—	0 ≤ 3.9.5

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287 Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)