EUVD-2026-21615Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | Although the CVSS score of 4.3 is moderate, the real-world risk is elevated due to multiple converging factors. The attack vector is network-based with low complexity, and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms authentication is required at Subscriber level or above-a commonly granted role on WordPress installations with open registration. The integrity impact is rated low (I:L) because the attacker modifies course structure rather than deleting data or escalating privileges, but in educational contexts, unauthorized reordering or reassignment of lessons to wrong topics significantly impacts course usability and student learning outcomes. The SSVC exploitation assessment favors prioritization: the attack is not automatable at scale (requires per-course ID enumeration), but the technical impact on course integrity is material. No active exploitation via CISA KEV is noted, and no public proof-of-concept code is documented, which reduces immediate threat severity but does not eliminate the need for patching given the low barrier to exploitation once discovered. |
| Exploit ScenarioDerived | An authenticated attacker with Subscriber-level access-a role typically available on WordPress sites with user registration enabled-crafts a POST request to the AJAX handler tutor_update_course_content_order containing a manipulated tutor_topics_lessons_sorting JSON payload with lesson IDs and topic IDs from courses they do not own. The handler processes the request without verifying the attacker's ownership of the target course, allowing the attacker to reorder lessons, detach them from their original topics, or reassign them to different topics in admin-owned or instructor-created courses. This does not require user interaction (UI:N) and can be executed directly via script or HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
RemediationAI
Vendor-released patch: version 3.9.8 and later. Site administrators should update the Tutor LMS plugin to version 3.9.8 or higher immediately via the WordPress plugin dashboard or direct download from the official repository. The patched version adds proper authorization verification within the save_course_content_order() method to ensure only users with appropriate course ownership or capabilities can modify course content structure. For sites unable to update immediately, restrict Subscriber-level user registration or assign Subscriber roles only to trusted educators, and monitor AJAX activity logs for suspicious tutor_update_course_content_order requests; however, these mitigations are temporary and do not eliminate the underlying vulnerability. See https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ftutor/tags/3.9.8 for detailed patch information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Tutor LMS plugin's AJAX handler tutor_update_course_content_order, which invokes the save_course_content_order() private method unconditionally. While the handler implements a can_user_manage() capability check for the content_parent branch, the save_course_content_order() method processes attacker-supplied tutor_topics_lessons_sorting JSON data without verifying course ownership or user capabilities. This represents a classic CWE-639 Authorization Bypass through User-Controlled Key pattern, where lesson and topic IDs supplied in the AJAX request are processed without validating that the authenticated user has legitimate authority over the target course. The affected plugin is identified via CPE as themeum:tutor_lms_-_elearning_and_online_course_solution, versions * through 3.9.7.
Know when Tutor Lms Elearning And Online Course Solution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the save_course_content_order() private method, which is called unconditionally by the tutor_update_course_content_order AJAX handler. While the handler's content_parent branch includes a can_user_manage() check, the save_course_content_order() call processes attacker-supplied tutor_topics_lessons_sorting JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Tutor LMS Plugin Authorization Bypass
View all 2Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with c
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthent
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and inc
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
GitHub PoC
Exploit-DB