CVE-2026-85571
UnknownSummary
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages. This allows users with instructor-level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
Risk Assessment
An instructor can take over other instructors' content and make arbitrary published content unreachable, leading to data integrity violations and site disruption.
Recommendation
Upgrade the Tutor LMS plugin to version 4.1.1 or later. Review post-to-course assignments for unauthorized changes.
Other vulnerabilities in Tutor LMS WordPress plugin
See all- CVE-2026-14310Medium
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify user access to the course a Q&A thread belongs to before returning or writing to that thread. Authenticated users with subscriber-level access and above who can access any single course can read Q&A threads of other courses and inject replies.
- CVE-2023-3133High
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Original NVD description (English source)
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS