What is the CVSS score of CVE-2026-3371?

CVE-2026-3371 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3371

EUVD-2026-21615 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-11 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:30 euvd

EUVD-2026-21615

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the save_course_content_order() private method, which is called unconditionally by the tutor_update_course_content_order AJAX handler. While the handler's content_parent branch includes a can_user_manage() check, the save_course_content_order() call processes attacker-supplied tutor_topics_lessons_sorting JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.

AnalysisAI

Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.

Technical ContextAI

The vulnerability exists in the Tutor LMS plugin's AJAX handler tutor_update_course_content_order, which invokes the save_course_content_order() private method unconditionally. While the handler implements a can_user_manage() capability check for the content_parent branch, the save_course_content_order() method processes attacker-supplied tutor_topics_lessons_sorting JSON data without verifying course ownership or user capabilities. This represents a classic CWE-639 Authorization Bypass through User-Controlled Key pattern, where lesson and topic IDs supplied in the AJAX request are processed without validating that the authenticated user has legitimate authority over the target course. The affected plugin is identified via CPE as themeum:tutor_lms_-_elearning_and_online_course_solution, versions * through 3.9.7.

RemediationAI

Vendor-released patch: version 3.9.8 and later. Site administrators should update the Tutor LMS plugin to version 3.9.8 or higher immediately via the WordPress plugin dashboard or direct download from the official repository. The patched version adds proper authorization verification within the save_course_content_order() method to ensure only users with appropriate course ownership or capabilities can modify course content structure. For sites unable to update immediately, restrict Subscriber-level user registration or assign Subscriber roles only to trusted educators, and monitor AJAX activity logs for suspicious tutor_update_course_content_order requests; however, these mitigations are temporary and do not eliminate the underlying vulnerability. See https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ftutor/tags/3.9.8 for detailed patch information.