VulnSocial

CVE-2026-14306Disclosure

LOWCVSS 4.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC and exploit tooling are both present
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-08: 1PoC Mentioned / Linked · 2026-07-08: 1Exploit Tool / Code · 2026-07-08: 1Technical Details · 2026-07-08: 107-08
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Dr. John Umoru@johnumorujo
    Disclosure

    I've been busy. I have two new CVEs disclosed: CVE-2026-57339: Business Directory Plugin (<= 6.4.23). it allowed unauthenticated deletion of any listing on a website. Then there is CVE-2026-14306: Tutor LMS (< 3.9.14). which was some sort of payment bypass where you could view lessons not paid for. Write-ups and PoCs are on my github: http://github.com/johnumorujo/published-cves #infosec #bugbounty #WordPress

    Post summary

    The user announces two newly disclosed CVEs, describes their impact, and links to PoC code on GitHub, providing both vulnerability details and proof‑of‑concept resources.

    5403761.8K
    798 followersView on X

Explore more

Back to dashboard