CVE-2026-14306 is an authorization bypass vulnerability in the Tutor LMS WordPress plugin prior to version 3.9.14. The flaw arises from improper verification of user enrollment status when restricting access to protected course content. As a result, authenticated users with subscriber-level privileges or higher who are enrolled in at least one course can view paid content (lessons, quizzes, assignments) belonging to other courses they are not enrolled in. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability allows unauthorized access to paid course content by authenticated users with subscriber-level access or above. This could lead to unauthorized disclosure of paid educational materials, potentially impacting the revenue model of the affected platform. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting subscriber-level access or implementing additional access controls to prevent unauthorized content viewing.