CVE-2026-92715
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
Risk Assessment
An attacker could modify or take over courses created by other instructors, potentially leading to data loss, unauthorized content changes, and intellectual property violations. This could undermine trust in the e-learning platform.
Recommendation
Update the plugin to a version later than 4.1.0 that fixes this vulnerability. If update is not possible, consider restricting author privileges or disabling the plugin.
Other vulnerabilities in Tutor LMS WordPress plugin
See all- CVE-2026-85571Medium
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages. This allows users with instructor-level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
- CVE-2026-14310Medium
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify user access to the course a Q&A thread belongs to before returning or writing to that thread. Authenticated users with subscriber-level access and above who can access any single course can read Q&A threads of other courses and inject replies.
- CVE-2023-3133High
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Original NVD description (English source)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS