Tutor LMS CVE-2026-57694

Exploitation requires a valid low-privilege WordPress account on the target site (PR:L per CVSS vector) - this could be a registered student, subscriber, or any role that can authenticate to the WordPress instance. The vulnerability is accessible over the network (AV:N) with no user interaction required (UI:N). Sites with open or easily obtainable user registration are at significantly higher realistic risk since an external attacker can self-register. Limiting factors: the requirement for at least a low-privilege authenticated session rules out fully unauthenticated remote exploitation. Sites that require manual admin approval for new accounts reduce exposure. No specific non-default configuration is documented as a prerequisite - the flaw appears to affect standard Tutor LMS deployments through 3.9.13. No special protocol, plugin sub-feature, or atypical configuration is identified as a trigger in the available advisory data.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity attack requiring only low-privilege authentication (PR:L) with no user interaction, resulting in high integrity impact. The absence of confidentiality impact (C:N) suggests the flaw is write-oriented rather than a data-disclosure issue. EPSS data was not provided, which limits probabilistic exploitation forecasting; however, IDOR vulnerabilities in popular WordPress plugins have historically attracted opportunistic mass exploitation due to automation feasibility. The plugin is not currently listed in CISA KEV, and no public exploit code has been identified at time of analysis. Patchstack reported this issue, which is a credible WordPress security research source. The scope is unchanged (S:U), meaning exploitation does not pivot to the broader WordPress core or host OS. Real-world priority: medium-high for any site where LMS data integrity is critical (e.g., certification platforms, paid course sites), but the lack of KEV listing and POC lowers immediate urgency compared to an unauthenticated or critical-CVSS issue. The requirement for PR:L limits fully unauthenticated mass exploitation, though open enrollment on many LMS sites means registration is trivial.

An attacker registers a free student account on a WordPress site running Tutor LMS 3.9.13 or earlier. By intercepting and replaying authenticated requests with manipulated object IDs - such as substituting another student's enrollment ID or a course content ID - the attacker modifies records they do not own, potentially altering quiz results, enrollment statuses, or course content. No public exploit code has been identified, but the low complexity (AC:L) and standard IDOR pattern make manual exploitation straightforward for any web tester.