CVE-2026-14187 is an authorization bypass vulnerability in the Tutor LMS WordPress plugin prior to version 4.0.6. The flaw arises from missing per-object ownership checks on course content, enabling any user assigned the instructor role to read private courses belonging to other instructors. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or detailed exploit information is available, and no patch or official remediation guidance has been published yet.

Users with the instructor role can access private course content of other instructors without proper authorization. This could lead to unauthorized disclosure of sensitive or proprietary educational materials. There is no indication of further privilege escalation or code execution impacts from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict instructor role assignments to trusted users only and monitor for any suspicious access to private course content.