Tutor LMS < 3.9.14 – Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass | CVE 2026-14306

Description

The plugin does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Proof of Concept

As a Subscriber enrolled in any (e.g. free) course whose ID is <FREE_COURSE_ID>:

1. Request a premium/paid lesson URL with no course parameter:
   https://TARGET/lessons/secret-premium-lesson/
   -> enrollment wall is shown, premium content absent.

2. Append the free course ID you are enrolled in:
   https://TARGET/lessons/secret-premium-lesson/?course=<FREE_COURSE_ID>
   -> the enrollment wall is gone and the full premium lesson body renders.

The same bypass applies to protected quizzes and assignments.