Tutor LMS CVE-2026-85571

Requires an authenticated account with Tutor LMS instructor-level access on a site running the plugin before 4.1.1, and exploitation is only impactful on multi-instructor deployments where other instructors' course content exists to be hijacked or orphaned. The specific trigger is the plugin's course content ordering request, which fails to verify that the posts named in the request belong to a course the requester manages. Limiting factors: the attacker must already hold a valid instructor account (not available to anonymous or subscriber-level users), there is no confidentiality impact, and a single-instructor site has little to steal - so realistic risk is confined to sites that grant instructor roles to semi-trusted or self-registered users.

This is a moderate-priority authorization flaw (CWE-639, insecure direct object reference) best understood as broken access control rather than a critical exposure. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base 6.5) shows network-reachable, low-complexity exploitation with no user interaction, but gated behind authenticated privileges (PR:H) and with no confidentiality impact - only integrity (I:H: reassigning the parent of any post, hijacking other instructors' course content) and availability (A:H: making published content unreachable). No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no signal of active or probable exploitation; absence of these is not evidence of safety but means prioritization rests on the CVSS and exploitation preconditions alone. The realistic exposure is limited to multi-instructor Tutor LMS deployments where an attacker already holds a legitimate instructor account, which makes this an insider/abuse-of-trust and lower-privilege-escalation issue rather than a wormable external threat. One signal worth verifying: the input tags this as 'Authentication Bypass,' which conflicts with the CWE-639 classification and the description - this is an authorization/IDOR issue, not an authentication bypass. Also note the privilege level is debatable: the vendor marked PR:H, but 'instructor level access' is typically a low-privilege authenticated role, which would raise the real score if assessed as PR:L.

On a WordPress site running a multi-instructor Tutor LMS (before 4.1.1), a malicious or compromised instructor sends a course content ordering request naming posts they do not own. Because the plugin never checks that the referenced posts belong to a course the requester manages, the attacker reassigns those posts' parent, stealing a rival instructor's lessons into their own course or orphaning published content so it becomes unreachable. No public exploit was identified at time of analysis, so exploitation would require the attacker to craft the request manually.