What is the CVSS score of CVE-2026-6965?

CVE-2026-6965 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Tutor LMS WordPress Plugin CVE-2026-6965

EUVD-2026-29914 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-13 Wordfence

WordPress Authentication Bypass Tutor Lms Elearning And Online Course Solution Wordpress Plugin Themeum

5.3

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Authenticate as instructor
Delivery

Identify victim course ID
Exploit

Craft GET request with attacker-controlled course parameter
Install

Submit request to vulnerable endpoint (Quiz.php, Lesson.php, Course.php, Ajax.php, or Announcements.php)
C2

get_course_id_by() extracts attacker-supplied course ID
Execute

can_user_manage() authorizes against attacker-controlled ID
Impact

Unauthorized operation executes on victim course

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Exploitation requires that the attacker possess an active WordPress user account with instructor-level role (or above) on the targeted Tutor LMS installation. The vulnerability is triggered by supplying a `course` GET parameter in requests to specific plugin endpoints (identified in classes/Lesson.php, Quiz.php, Course.php, Ajax.php, Announcements.php) that the attacker does not own. No special plugin configuration is required - the vulnerable behavior is present in default installations of Tutor LMS versions up to 3.9.9. The attacker must know or guess the numeric course ID of the victim course to target it, though course IDs are typically sequential and easily enumerable via the course listing endpoints. Exploitation is limited to operations the instructor role grants (content deletion, modification, grade changes) and does not provide access to administrative functions or student personal data beyond unpublished course content and quiz answers.
Impact	The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) presents a moderate baseline, but this score contains a critical mismatch: the CVSS vector shows PR:N (no privileges required), yet the CVE description explicitly states the vulnerability requires 'authenticated attackers, with instructor-level access and above.' This indicates the CVSS vector data in the input is incorrect or incomplete; the actual risk profile should be evaluated as requiring PR:H (instructor-level privilege). Under the corrected assumption (PR:H), the real-world risk is HIGH for multi-instructor WordPress installations where instructor-to-instructor trust is not absolute. The attack vector is network-based and complexity is low - any authenticated instructor with knowledge of another instructor's course ID can immediately execute the attack via simple GET parameter manipulation, requiring no user interaction or exploit code. The impact is severe and asymmetric: an attacker can permanently delete course content, cascade-delete student attempt records, manipulate grades, and exfiltrate unpublished content, yet the integrity impact is scored as 'Low' in CVSS (likely because the scope is unchanged and only one course's content is affected per request). However, in the context of multi-course platforms, the cumulative impact across multiple courses, combined with data destruction and grade manipulation, exceeds typical 'Low' integrity thresholds in practice. The absence of EPSS score and KEV status suggests this vulnerability may have been recently disclosed or is not yet in active exploitation campaigns, reducing the exploitation probability signal. For organizations relying on Tutor LMS with multiple instructors, this is a CRITICAL PRIORITY vulnerability despite the moderate CVSS number, as it enables course sabotage and data destruction with minimal attacker effort.
Exploit ScenarioDerived	An instructor at a competing online education provider, having obtained a WordPress account with instructor-level access to a shared Tutor LMS installation, navigates to the course editing interface and modifies the GET parameter `course=123` to `course=999` (where 999 is a victim instructor's course ID) in their browser address bar. The attacker then submits a request to delete a quiz via the vulnerable endpoint at classes/Ajax.php line 586. The get_course_id_by() function extracts the attacker-controlled course ID 999, passes it to can_user_manage(), which confirms the attacker is authorized to manage course 999 (because the authorization check is against the attacker-supplied ID, not the actual content ownership), and the delete operation executes, permanently removing the quiz and all associated student attempt records from the victim's course.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-controlled GET parameter to perform unauthorized operations on other instructors' courses, including deleting lessons, quizzes, assignments, and student data, or modifying course content and grades. The vulnerability stems from the get_course_id_by() function unconditionally trusting user-supplied input instead of validating course ownership, bypassing the plugin's primary authorization gate. No public exploit code or active exploitation has been identified at time of analysis.

RemediationAI

Update the Tutor LMS plugin to a patched version once released by Themeum - no specific fix version is confirmed in the provided data, so monitor the official plugin repository and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/55924ea3-373c-4297-a958-5670def1f6c0 for patch availability. As an immediate compensating control, restrict instructor-level WordPress user role assignments to trusted administrators only and implement WordPress user role management policies that limit the number of users with instructor capabilities. Additionally, if the plugin supports it, implement course-level access controls or audit logging to detect unauthorized course modifications. These measures do not eliminate the vulnerability but reduce the attacker pool from all instructors to only those with administrative trust. Database backups should be increased in frequency prior to patching to enable rapid recovery from course content deletion attacks. Note that disabling the plugin entirely is the only way to eliminate exploitation risk until a patch is available, though this will render course management functionality unavailable.

Affected VersionsENISA

Tutor LMS – eLearning and online course solution 0 ≤3.9.9

Affected Packages

euvd tutor_lms_elearning_and_online_course_solution no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Tutor LMS is a WordPress plugin that provides learning management system functionality, including course creation, lesson management, quiz administration, and student grade tracking. The vulnerability exists in the authorization architecture: the get_course_id_by() function in the Utils class accepts a user-supplied course GET parameter and returns it directly without validation, which is then passed to the can_user_manage() function - the sole authorization gate for instructor-level operations. The can_user_manage() function checks whether the current user is an instructor for the supplied course ID, but because that course ID is attacker-controlled, an authorized instructor can claim to manage any course in the system. This Insecure Direct Object Reference (CWE-639) pattern is repeated across multiple content handlers in classes such as Lesson, Quiz, Course, Ajax, and Announcements, each of which retrieves the course ID from the GET parameter and uses it in authorization decisions rather than deriving the course ownership from the target content object itself.

Know when Tutor Lms Elearning And Online Course Solution gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the get_course_id_by() function unconditionally trusting the user-supplied course GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by can_user_manage(), the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.