Tutor LMS EUVD-2026-43289

Exploitation requires an authenticated session with at minimum WordPress instructor-level role within the Tutor LMS plugin - this is a non-default role created by the plugin itself, distinct from standard WordPress Subscriber or Editor roles. The vulnerability is present only when the Tutor LMS plugin is installed and active; it does not affect WordPress core. No special server configuration, non-default WordPress settings, or specific Tutor LMS feature toggle is required beyond the plugin being active. Exploitation is limited to users who have been granted the instructor role either by an administrator or through open self-enrollment; unauthenticated visitors cannot exploit this flaw. The CVSS PR:L metric confirms low-privilege (authenticated) access is required.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the exploitation profile: network-reachable, no complexity, requires only a low-privilege instructor account, and produces high integrity impact. No EPSS score was provided in the intelligence; however, the combination of a publicly available POC reported by WPScan and a low authentication bar (instructor role) suggests real-world exploitation probability is meaningfully above zero, particularly on multi-tenant or open-enrollment installations where attacker-controlled instructor accounts are easily obtained. The absence of a CISA KEV entry indicates no confirmed mass exploitation at time of analysis. The 'Information Disclosure' tag in the source intelligence appears to be a mislabeling - the actual impact is integrity-based content takeover, not data exfiltration. The CVSS Scope metric (S:U) understates the practical blast radius: overwriting an administrator's pages (login page, landing page, policy pages) can enable phishing, SEO poisoning, or defacement within the same WordPress installation.

An attacker registers or obtains an instructor-level account on a target WordPress site running Tutor LMS below 3.9.13 - feasible on open-enrollment LMS platforms. Using the publicly available POC, the attacker sends a crafted POST request to the plugin's content-builder save handler, specifying the post ID of an administrator-owned page (e.g., the site's homepage or login redirect page) as the target while authenticating with their instructor session. The authorization check passes against the unrelated identifier, and the handler overwrites the target post's content with attacker-controlled material, enabling defacement, phishing page injection, or SEO manipulation.