What is GHSA-6c7v-vhfc-h7pv?

GHSA-6c7v-vhfc-h7pv is a security advisory published by GitHub Security Advisories with Low severity. The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its...

Which CVE IDs does GHSA-6c7v-vhfc-h7pv cover?

GHSA-6c7v-vhfc-h7pv covers the following CVE IDs: CVE-2026-14187. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6c7v-vhfc-h7pv?

GHSA-6c7v-vhfc-h7pv has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-6c7v-vhfc-h7pvLowCVSS 2.7

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its...

Vendor

GitHub Security Advisories

Published

August 22, 2026

Last Modified

August 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-14187 →

📋 Description

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14187
https://wpscan.com/vulnerability/fb006829-e298-4b22-9d62-293a3b917ccd
https://github.com/advisories/GHSA-6c7v-vhfc-h7pv