CVE-2026-0953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0953", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-14T19:02:05.215Z", "datePublished": "2026-03-10T05:26:28.745Z", "dateUpdated": "2026-04-08T17:09:29.685Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:29.685Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address."}], "title": "Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92a120ac-66ae-4678-a87a-e62da885d50b?source=cve"}, {"url": "https://tutorlms.com/releases/id/393/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication", "cweId": "CWE-287", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "timeline": [{"time": "2026-01-14T19:18:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-09T16:33:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:58:52.010194Z", "id": "CVE-2026-0953", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:52:06.341Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T15:58:52.010194Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:58:53.646Z"}}], "cna": {"title": "Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS Pro", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.9.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-14T19:18:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-09T16:33:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92a120ac-66ae-4678-a87a-e62da885d50b?source=cve"}, {"url": "https://tutorlms.com/releases/id/393/"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-10T05:26:28.745Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0953", "state": "PUBLISHED", "dateUpdated": "2026-03-10T16:52:06.341Z", "dateReserved": "2026-01-14T19:02:05.215Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-10T05:26:28.745Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tutor LMS Pro", "vendor": "themeum", "versions": [{"lessThanOrEqual": "3.9.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address."}, {"lang": "es", "value": "El plugin Tutor LMS Pro para WordPress es vulnerable a una omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 3.9.5, inclusive, a trav\u00e9s del complemento Social Login. Esto se debe a que el plugin no verifica que el correo electr\u00f3nico proporcionado en la solicitud de autenticaci\u00f3n coincida con el correo electr\u00f3nico del token OAuth validado. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario existente, incluidos los administradores, al proporcionar un token OAuth v\u00e1lido de su propia cuenta junto con la direcci\u00f3n de correo electr\u00f3nico de la v\u00edctima."}], "id": "CVE-2026-0953", "lastModified": "2026-06-17T10:11:40.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0953", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T15:58:52.010194Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:31:40.537", "references": [{"source": "security@wordfence.com", "url": "https://tutorlms.com/releases/id/393/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92a120ac-66ae-4678-a87a-e62da885d50b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.5]"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Tutor LMS Pro", "source": "cna", "vendor": "themeum"}, "product": "tutor_lms", "vendor": "themeum"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:43:34.288022+00:00", "value": {"mitigation_remediation": ["Upgrade Tutor LMS Pro to version 3.9.6 or later to apply the vendor\u2019s fix.", "If a patch cannot be applied immediately, disable the Social Login addon to remove the vulnerable authentication path.", "Perform a security audit of user accounts and authentication logs to detect any unauthorized access that may have occurred prior to mitigation."], "summary": {"action": "Immediate Patch", "impact": "Authentication bypass enabling unauthorized privileged access"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Tutor LMS Pro plugin version 3.9.5 or earlier, including those with the Social Login addon enabled. The affected vendor is Themeum for Tutor LMS Pro. No additional version details are supplied beyond the <= 3.9.5 range.", "description_and_impact": "The vulnerability allows an attacker to circumvent authentication by providing a valid OAuth token from their own account together with any victim\u2019s email address. The plugin does not verify that the email in the request matches the email returned by the OAuth provider, so unauthenticated users can log in as any existing user, including administrators. This flaw results in full impersonation and unauthorized control over the WordPress site. The weak point is an authentication validation weakness (CWE-287).", "risk_and_exploitability": "The CVSS base score is 9.8, indicating critical severity, while the EPSS score is less than 1%, suggesting that widespread exploitation is not currently observed but the vulnerability remains potent. The flaw is not listed in the CISA KEV catalog, but because it grants full administrative access with minimal prerequisites\u2014a valid OAuth token and any email address\u2014it poses a high risk wherever the plugin is installed. The likely attack vector is through the Social Login integration, where an attacker can submit crafted authentication requests to the plugin\u2019s OAuth endpoint to obtain a session as any user."}}}}, "created": "2026-03-11T11:50:35.881799+00:00", "updated": "2026-04-15T17:45:10.761683+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}