Skip to main content

Tutor LMS EUVDEUVD-2026-83467

| CVE-2026-89333 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-09-19 Wordfence GHSA-fjhh-mxpw-32j7
WordPress Tutor Lms Elearning And Online Course Solution Wordpress Plugin Themeum
6.5
CVSS 3.1 · Vendor: Wordfence
Share

Severity by source

Vendor (Wordfence) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
4.3 MEDIUM

Network IDOR needing only subscriber auth (PR:L), no UI; impact limited to two PII fields so C:L not C:H, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Metadata Corrected
Sep 19, 2026 - 03:40 vuln.today
tag: Authentication Bypass removed
Analysis Generated
Sep 19, 2026 - 03:01 vuln.today
CVE Published
Sep 19, 2026 - 02:27 cve.org
MEDIUM 6.5

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.

AnalysisAI

Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated WordPress account at subscriber level or above on a site running the Tutor LMS plugin version 4.0.8 or earlier; open user registration (common on LMS/course sites) makes obtaining that account trivial. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a moderate-priority, authenticated information-disclosure flaw rather than a critical remote compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Patch status: Upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tutor Lms Elearning And Online Course Solution

View all
CVE-2026-78175 HIGH
8.8 Sep 12

Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
CVE-2026-3360 HIGH
7.5 Apr 10

Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
CVE-2026-16759 MEDIUM
6.5 Aug 28

Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
CVE-2026-15022 MEDIUM
6.5 Jul 16

Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with c
CVE-2026-6080 MEDIUM
6.5 Apr 17

SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
CVE-2026-13443 MEDIUM
6.4 Jul 01

Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
CVE-2026-89081 MEDIUM
6.1 Sep 19

Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthent
CVE-2026-3358 MEDIUM
5.4 Apr 11

Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to

CVE-2026-6965 MEDIUM
5.3 May 13

Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
CVE-2026-5502 MEDIUM
5.3 Apr 17

Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
CVE-2026-10736 MEDIUM
4.9 Jun 18

SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authentic
CVE-2026-15444 MEDIUM
4.9 Jul 28

Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Share

EUVD-2026-83467 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy