CVE-2026-0953 PUBLISHED

Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login

Assigner: Wordfence
Reserved: 14.01.2026 Published: 10.03.2026 Updated: 10.03.2026

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor themeum
Product Tutor LMS Pro
Versions Default: unaffected
  • affected from * to 3.9.5 (incl.)

Credits

  • Nguyen Tan Phat finder

References

Problem Types

  • CWE-287 Improper Authentication CWE