EUVD-2026-83467
GHSA-fjhh-mxpw-32j7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network IDOR needing only subscriber auth (PR:L), no UI; impact limited to two PII fields so C:L not C:H, with no integrity or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
AnalysisAI
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account at subscriber level or above on a site running the Tutor LMS plugin version 4.0.8 or earlier; open user registration (common on LMS/course sites) makes obtaining that account trivial. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, authenticated information-disclosure flaw rather than a critical remote compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: Upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with c
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthent
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authentic
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive
Share
External POC / Exploit Code
Leaving vuln.today