Tutor LMS CVE-2026-18439

Requires an authenticated account with Instructor-level access or above on a WordPress site running Tutor LMS 4.0.7 or earlier. Exploitation is meaningful primarily on multi-instructor/multi-tenant course sites where quiz questions and answers belonging to other instructors or administrators exist to be overwritten, re-parented, or deleted; on a single-operator site there are no other users' rows to abuse. The attacker sends the tutor_quiz_builder_save AJAX action with valid top-level course_id/topic_id they control but nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values pointing at other users' quiz rows. No end-user interaction is required (UI:N). The Instructor privilege requirement is the key limiting factor bounding realistic risk.

The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning network-reachable but requiring authenticated Instructor-level (or higher) access and yielding only limited integrity impact (no confidentiality, no availability per the vendor vector - though arbitrary deletion of quiz/answer rows arguably touches availability of that content). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The privilege barrier (PR:L, Instructor+) is the dominant limiting factor: the attacker must already be a trusted content author on the target LMS, which sharply narrows the population of potential abusers to insiders or attackers who have compromised/registered an instructor account. There is no SSVC decision data provided. Net assessment: this is a genuine but bounded cross-tenant integrity issue (one instructor tampering with or deleting another instructor's/admin's quiz data), not a high-urgency internet-wide threat - a real-priority fix for multi-instructor course platforms but low real-world risk for single-operator sites. Note the input tag 'Authentication Bypass' conflicts with the actual weakness (CWE-639 IDOR/broken object-level authorization); authentication is required, so this is an authorization flaw, not an auth bypass.

An authenticated user holding Instructor privileges on a multi-instructor Tutor LMS site submits a crafted tutor_quiz_builder_save AJAX request whose top-level course_id/topic_id belong to their own quiz but whose nested question_id, answer_id, deleted_question_ids[], or deleted_answer_ids[] values reference another instructor's or an administrator's quiz rows. Because the handler validates only the top-level identifiers and passes the nested IDs straight into $wpdb->update/DELETE, the attacker overwrites, re-parents, or deletes arbitrary quiz questions and answers belonging to other users. No public exploit code is identified at time of analysis.