EUVD-2026-23360Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.
AnalysisAI
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
Technical ContextAI
The Tutor LMS plugin (CPE: cpe:2.3:a:themeum:tutor_lms_-_elearning_and_online_course_solution:*:*:*:*:*:*:*:*) implements a WordPress AJAX handler in the tutor_update_course_content_order() function within the Course.php class that processes requests to reorder course content. The function checks the nonce (CSRF token) for request validity but conditionally performs the critical authorization check can_user_manage() only when the 'content_parent' parameter exists in the request. This is a classic authorization bypass pattern (CWE-862: Missing Authorization) where the authorization logic is placed behind a conditional branch that can be circumvented by omitting a specific request parameter. When 'content_parent' is absent, the function proceeds directly to save_course_content_order(), which directly manipulates WordPress post meta and menu_order fields in the wp_posts table without verifying the user has capability to edit course content. The nonce-only validation provides CSRF protection but does not authenticate user permissions for the specific action being performed.
RemediationAI
Upgrade Tutor LMS plugin to version 3.9.9 or later immediately via the WordPress plugin update interface (Plugins > Updates in WordPress admin dashboard) or manually by downloading the patched version from plugins.wordpress.org/plugin/tutor/. The patch adds proper authorization checks that execute regardless of the presence or absence of the 'content_parent' parameter. For sites unable to immediately upgrade, restrict WordPress user roles to prevent subscriber and low-privilege users from accessing course management functions via user role editor plugins or capability management tools (note: this is a workaround with high operational overhead and does not address the underlying vulnerability, as higher-privilege roles like instructors retain risk). Verify the update completes successfully by checking Plugins page to confirm version 3.9.9 or higher is active.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today