Tutor Lms Elearning And Online Course Solution CVE-2026-5502

Exploitation requires: (1) the attacker must be a registered and authenticated WordPress user with any role that can make AJAX requests (subscriber level or above); (2) the Tutor LMS plugin must be version 3.9.8 or earlier; (3) the attacker must submit an AJAX request to tutor_update_course_content_order with a valid WordPress nonce but WITHOUT the 'content_parent' parameter in the request payload; (4) the course being modified must exist on the site. The vulnerability is triggered specifically when the 'content_parent' parameter is omitted - its presence in the request causes the authorization check (can_user_manage()) to execute and block unauthorized users. Default WordPress configurations do not prevent subscriber-level users from making AJAX requests, so no non-standard configuration is required. The limiting factors are: (a) requirement for authenticated access (not true unauthenticated/PR:N despite CVSS vector), (b) necessity to craft parameter-free requests (not typical UI interaction), and (c) targeting of course content ordering (low business impact compared to data theft or account compromise).

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible, unauthenticated exploitation; however, this conflicts with the description stating 'authenticated attackers with subscriber-level access and above.' The CVSS vector appears inconsistent with the described requirement for authentication (PR should be PR:L for low privileges, not PR:N). The integrity impact (I:L) correctly reflects unauthorized modification of course structure. Real-world risk is moderate: while any authenticated user can exploit this, the impact is limited to course content ordering and structure rather than data exfiltration or system compromise. The vulnerability requires the attacker to be registered and logged into the WordPress site, significantly narrowing the attack surface compared to a truly unauthenticated (PR:N) flaw. The conditional nature of the authorization bypass (dependent on parameter omission) means exploitation requires deliberate crafting of requests; standard UI interactions will likely include the 'content_parent' parameter and trigger the authorization check. No active exploitation has been confirmed in the wild, and the fix is available in version 3.9.9. CRITICAL DISCREPANCY: CVSS vector states PR:N (no authentication required), but description explicitly states 'authenticated attackers with subscriber-level access' - verify with Wordfence or vendor whether unauthenticated exploitation is possible or if CVSS vector should reflect PR:L.

An attacker with a registered WordPress subscriber-level account (or higher) logs into the site and crafts a direct HTTP POST request to the WordPress AJAX handler (wp-admin/admin-ajax.php?action=tutor_update_course_content_order) with a valid nonce but deliberately omitting the 'content_parent' parameter. The request includes menu_order values to reorder course lessons. The vulnerable function bypasses the can_user_manage() check (which would normally block this action), processes the request, and updates the WordPress database, causing all lessons in a course to be detached from their topics or reordered maliciously. A course instructor or site administrator would discover the course structure corrupted, though no content is deleted or exposed.