What is the CVSS score of CVE-2026-57694?

CVE-2026-57694 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Tutor LMS CVE-2026-57694

EUVD-2026-43352 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 Patchstack

Authentication Bypass Tutor Lms WordPress Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible IDOR requiring only low-privilege auth; write-only impact with no confidentiality or availability effect aligns with object-modification scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:21 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Tutor LMS WordPress plugin allows authenticated low-privilege users to bypass authorization controls by manipulating user-controlled keys, resulting in unauthorized modification of LMS objects such as courses, lessons, or student records. Affected versions span all releases through 3.9.13 by Themeum. No confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface make this a credible integrity risk for any site running an unpatched version.

Technical ContextAI

Tutor LMS (CPE: cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:*:*:*) is a feature-rich WordPress Learning Management System plugin by Themeum. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), commonly manifested as an Insecure Direct Object Reference (IDOR): the application uses attacker-supplied identifiers - such as course IDs, enrollment IDs, or user IDs embedded in HTTP parameters - to resolve server-side objects without verifying that the requesting user has authorization to act on those specific objects. A low-privilege WordPress user (e.g., a student or subscriber) can therefore substitute an ID belonging to another user or privileged content and perform write operations that should be restricted. The CVSS vector confirms network accessibility (AV:N), no required user interaction (UI:N), and high integrity impact (I:H), with no confidentiality or availability impact flagged.

RemediationAI

The primary fix is to update Tutor LMS to a version beyond 3.9.13 once a patched release is published by Themeum; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-13-insecure-direct-object-references-idor-vulnerability for the confirmed patched version, which was not independently confirmed in the available data (see confidence notes). No vendor-released patch version was specified in the provided intelligence - do not assume a fixed release exists without verifying with Themeum or the WordPress plugin repository. As a compensating control, sites with open user registration should consider restricting registration to vetted accounts only, reducing the pool of potential low-privilege attackers. Deploying a Web Application Firewall (WAF) rule that validates object ownership server-side for LMS API endpoints can reduce exploitability, though this is non-trivial to configure correctly and may break legitimate plugin functionality. Monitoring WordPress audit logs for unexpected modifications to course, enrollment, or user objects by low-privilege roles can serve as a detection control.