CVE-2026-85571

Deferred Deferred - Pending Action

Tutor LMS Course Content Reassignment Vulnerability

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: WPScan

Description

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85571

EUVD

EUVD-2026-96129

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Tutor	LMS 4.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Tutor LMS WordPress plugin versions 4.0.5 to 4.1.0. It allows users with instructor-level access to reassign the parent of any post on the site, including moving other instructors' course content into their own courses. This can make published content unreachable and disrupt course management.

Detection Guidance

Check if your Tutor LMS plugin version is between 4.0.5 and 4.1.0. Inspect WordPress logs for unusual post parent reassignment events or unauthorized course content modifications.

Impact Analysis

If you are an instructor using Tutor LMS versions 4.0.5 to 4.1.0, another instructor could take control of your course content by moving it into their courses. This could lead to loss of access to your content, disruption of your courses, and potential data integrity issues.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to or modification of sensitive data, such as course content containing personal or protected information. This may violate data integrity and access control requirements under GDPR, HIPAA, or other regulations.

Mitigation Strategies

Update Tutor LMS to version 4.1.1 or later immediately. Review and audit course content ownership to identify any unauthorized reassignments. Restrict instructor-level access to only necessary users.

Hi! I’m here to help you understand CVE-2026-85571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70