Tutor LMS EUVD-2026-103222

Requires an authenticated account with Tutor LMS author-level (instructor) capability or above (PR:L); there is no remote unauthenticated path. No non-default configuration is needed - the flaw is in the default course-save handling of all versions up to and including 4.1.0, where Input::sanitize_array() fails to strip the attacker-supplied 'ID' POST key and wp_insert_post() then treats a non-empty ID as an update to an existing post. Exploitation is limited to environments that grant untrusted or multiple users the instructor/author role; single-author sites or sites that do not expose author-level registration are effectively not exposed. No end-user interaction is required.

This is a legitimate but moderate-severity authorization flaw, not a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3 Medium) correctly captures the shape: network-reachable, low complexity, but requiring authenticated author-level (instructor) privileges and delivering an integrity-only impact with no confidentiality or availability loss. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active or widespread exploitation. The privilege precondition (PR:L, author-level) meaningfully constrains the attacker population to users who already hold trusted instructor roles, which is the dominant risk-limiting factor. One point of divergence worth flagging: I assess the integrity impact higher than the input's I:L, because the attacker can overwrite ARBITRARY courses belonging to other instructors and reassign ownership to themselves (a cross-tenant data-integrity compromise affecting multiple victims), which pushes my independent CVSS to 6.5. No SSVC decision data was supplied. Overall this warrants routine patch prioritization on multi-instructor Tutor LMS sites rather than emergency response.

A malicious or compromised instructor (author-level) account on a Tutor LMS site submits a course-save request that includes the 'ID' parameter pointing at a course owned by a different instructor. Because the plugin preserves the attacker-supplied ID and passes it to wp_insert_post(), WordPress treats the request as an update, letting the attacker overwrite that course's title, content, and status and reassign its ownership to themselves. No public exploit code was identified in the source data; exploitation is manual and requires a valid author-level account.