EUVD-2026-83474
GHSA-95p6-v6qj-q4v6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated subscriber (PR:L) over the network (AV:N); the multi-step upload-reparent-delete chain justifies AC:H; permanent content deletion affects integrity (I:L) and availability of deleted content (A:L), with no data disclosure (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts - including pages, courses, quizzes, and WooCommerce products - via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.
AnalysisAI
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account at subscriber level or above on a site running Tutor LMS ≤4.0.8 (open user registration or paid-course enrollment makes this trivially obtainable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-low despite the destructive potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The input does not state an exact patched release version; the upstream fix is referenced as plugin repository changeset 3700174 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3700174%40tutor&new=3700174%40tutor), so the correct action is to confirm the fix in the plugin changelog, apply the Tutor LMS release carrying that changeset, and verify the installed version is above 4.0.8 - treat this as 'upstream fix available (commit/changeset); released patched version not independently confirmed' until the vendor advisory names the version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with c
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthent
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authentic
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today