EUVD-2026-43287
GHSA-pqgf-9jm9-v6q5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-exploitable with any subscriber account (PR:L); no confidentiality loss; integrity and availability both Low from score/completion record tampering.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
AnalysisAI
Missing ownership verification in Tutor LMS WordPress plugin before 3.9.13 allows any authenticated subscriber-level user to overwrite other students' quiz attempt records, including their scores and pass/fail status. The flaw is an insecure direct object reference (IDOR) pattern: the plugin writes to quiz attempts without confirming the requesting user owns that attempt. A public exploit exists per WPScan, meaning the technique is documented and reproducible; however, this CVE is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation at time of analysis.
Technical ContextAI
Tutor LMS is a feature-rich Learning Management System plugin for WordPress, identified via CPE cpe:2.3:a:unknown:tutor_lms:*:*:*:*:*:*:*:*. The root cause is a missing authorization check on quiz attempt write operations - the plugin fails to validate that the authenticated user making the modification request is the same user who owns the target quiz attempt. This is characteristic of an Insecure Direct Object Reference (IDOR) or broken object-level authorization flaw (no CWE was formally assigned, but the pattern aligns with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key). Because WordPress subscriber accounts are freely self-registerable on most installations, the effective privilege barrier is very low. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the attack is purely network-driven with no interaction or configuration complexity required beyond holding a valid low-privilege account.
RemediationAI
Upgrade Tutor LMS to version 3.9.13 or later; this is the vendor-confirmed patched release. Site administrators should apply the update immediately via the WordPress plugin dashboard or by downloading from the WordPress plugin repository. If immediate patching is not possible, a compensating control is to disable open self-registration on the WordPress site (Settings → General → uncheck 'Anyone can register'), which raises the attacker barrier from 'any subscriber' to 'accounts provisioned by an admin'. This mitigation has the trade-off of breaking self-service enrollment workflows. Additionally, reviewing quiz attempt logs for anomalous modification patterns (e.g., a subscriber account touching attempt records belonging to other users) can help identify whether exploitation has already occurred. The WPScan advisory at https://wpscan.com/vulnerability/ca99ea35-4bf8-4dc8-a817-79fb9fa1c5bd/ should be referenced for any additional vendor guidance.
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers o
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Several AJAX endpoints in the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7.7 were unprot
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowi
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-le
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS - eLearning and online course soluti
The tutor_place_rating AJAX action from the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS - eLearning and online course solution WordPress
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today