EUVD-2026-43289
GHSA-c7pm-q6w7-5993
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable plugin endpoint, instructor session required (PR:L), no complexity or interaction; integrity fully compromised via post overwrite, no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
AnalysisAI
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-level user to overwrite and take over arbitrary posts or pages sitewide, including administrator-owned content. The content-builder save handler validates the request against an unrelated identifier rather than confirming the requesting user owns or is permitted to edit the target post, making the authorization check entirely ineffective. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis, though the low barrier (instructor account only) and high integrity impact elevate real-world risk significantly.
Technical ContextAI
Tutor LMS is a WordPress-native learning management system plugin that exposes a content-builder interface for creating course content. The flaw resides in one of the plugin's AJAX or REST save handlers responsible for persisting builder content to WordPress posts. Rather than performing a capability check against the target post ID (e.g., verifying current_user_can('edit_post', $target_post_id)), the handler evaluates authorization against an unrelated identifier - a classic Insecure Direct Object Reference (IDOR) / Broken Object-Level Authorization (BOLA) pattern, conceptually aligned with CWE-639 (Authorization Bypass Through User-Controlled Key), though the NVD entry does not specify a formal CWE. CPE data identifies the affected component as cpe:2.3:a:unknown:tutor_lms:*:*:*:*:*:*:*:* covering all versions prior to 3.9.13. The WordPress role system is the relevant boundary: WordPress grants instructors elevated but non-admin privileges, and the plugin fails to enforce the additional boundary that instructors may only modify their own content.
RemediationAI
Update Tutor LMS to version 3.9.13 or later; this is the vendor-confirmed patched release per the WPScan advisory at https://wpscan.com/vulnerability/c3d98ead-a4f4-48fd-bf9c-4fa91c5681d7/. If immediate patching is not possible, the most effective compensating control is to suspend or remove all non-trusted instructor accounts until the patch is applied, since exploitation requires at minimum an instructor-level session. Alternatively, a Web Application Firewall rule targeting the vulnerable content-builder AJAX action (if identifiable from the plugin's source) can block the malicious save request, though this may disrupt legitimate instructor workflows. Restricting WordPress REST API or AJAX endpoints to authenticated administrator sessions only is a more aggressive but disruptive option. There are no known trade-off-free workarounds - the underlying authorization logic must be patched.
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers o
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Several AJAX endpoints in the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7.7 were unprot
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowi
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS - eLearning and online course soluti
The tutor_place_rating AJAX action from the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS - eLearning and online course solution WordPress
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS - eLearning and online course solution Wor
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today