Tutor LMS CVE-2026-85569

Exploitation requires the attacker to possess a valid Tutor LMS REST API credential - specifically a read-only key issued by an administrator on the target site. The flaw is that the plugin (a) fails to correctly determine that an incoming request is addressed to its own REST API and (b) does not enforce the read-only permission recorded against that credential, so requests are executed with the privileges of the issuing administrator. Limiting factors: the site must have provisioned at least one API key, and the attacker must obtain it (granted, leaked, or captured); no additional user interaction is needed. Affected only on Tutor LMS versions 2.7.1 up to (not including) 4.0.8 - upgrading to 4.0.8 remediates.

This is a genuine privilege-escalation flaw (CWE-269) in which a holder of a read-only Tutor LMS API credential can act as the administrator account that issued it, yielding full C:H/I:H/A:H impact - effectively total site takeover of the affected WordPress installation. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) scores 7.2, but the PR rating is debatable: the credential required is explicitly READ-ONLY (a low-privilege secret), so PR:L is arguably more accurate, which would raise the score toward 8.8 - verify PR intent with WPScan/vendor. Multi-source signals are mixed: a public exploit exists (WPScan), which raises practical exploitability, but EPSS is only 0.17% (7th percentile) and there is no CISA KEV listing, indicating no confirmed mass exploitation yet. The key limiter is credential possession - the attacker must already hold a valid Tutor LMS API key (even a read-only one), so this is not a fully unauthenticated internet-wide bug; it is a serious escalation path for anyone who has been granted, leaked, or captured such a key. Net: a real priority for sites that provision Tutor LMS API keys to integrations or lower-trust users, but the required credential and low EPSS temper its blast radius relative to the raw 7.2/8.8 severity.

An integration, third-party service, or lower-trust user is issued a read-only Tutor LMS API key by a site administrator. Using that key, the attacker sends REST API requests that the plugin fails to correctly scope, and the plugin honors them as the issuing administrator - letting the attacker perform admin-level actions (create users, change content/settings) and take over the site. A public exploit is available from WPScan, lowering the skill barrier.