EUVD-2026-23360Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.
AnalysisAI
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
Technical ContextAI
The Tutor LMS plugin (CPE: cpe:2.3:a:themeum:tutor_lms_-_elearning_and_online_course_solution:*:*:*:*:*:*:*:*) implements a WordPress AJAX handler in the tutor_update_course_content_order() function within the Course.php class that processes requests to reorder course content. The function checks the nonce (CSRF token) for request validity but conditionally performs the critical authorization check can_user_manage() only when the 'content_parent' parameter exists in the request. This is a classic authorization bypass pattern (CWE-862: Missing Authorization) where the authorization logic is placed behind a conditional branch that can be circumvented by omitting a specific request parameter. When 'content_parent' is absent, the function proceeds directly to save_course_content_order(), which directly manipulates WordPress post meta and menu_order fields in the wp_posts table without verifying the user has capability to edit course content. The nonce-only validation provides CSRF protection but does not authenticate user permissions for the specific action being performed.
RemediationAI
Upgrade Tutor LMS plugin to version 3.9.9 or later immediately via the WordPress plugin update interface (Plugins > Updates in WordPress admin dashboard) or manually by downloading the patched version from plugins.wordpress.org/plugin/tutor/. The patch adds proper authorization checks that execute regardless of the presence or absence of the 'content_parent' parameter. For sites unable to immediately upgrade, restrict WordPress user roles to prevent subscriber and low-privilege users from accessing course management functions via user role editor plugins or capability management tools (note: this is a workaround with high operational overhead and does not address the underlying vulnerability, as higher-privilege roles like instructors retain risk). Verify the update completes successfully by checking Plugins page to confirm version 3.9.9 or higher is active.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
We need to produce a JSON object with specific fields. Let's analyze the CVE data. First: product_name: "1-3 words ONLY
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authentic
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-leve
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today