Executive Summary

CVE-2026-23799 is a Broken Access Control vulnerability in the WordPress Tutor LMS Plugin versions up to and including 3.9.5. It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows unprivileged users to perform actions that should be restricted to higher-privileged roles.

This vulnerability is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS score of 6.5, indicating moderate severity.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows users with only subscriber-level privileges to exploit the system and perform actions reserved for higher-privileged roles. This can lead to unauthorized access and manipulation of the Tutor LMS plugin's functionality."}, {'type': 'paragraph', 'content': 'The impact includes potential unauthorized changes to course content, user data, or administrative settings, which can compromise the integrity and security of the learning management system.'}, {'type': 'paragraph', 'content': 'Prompt patching by updating to version 3.9.6 or later is essential to mitigate this risk.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization checks in the Tutor LMS WordPress plugin, allowing unprivileged users to perform restricted actions. Detection typically involves monitoring for unauthorized access attempts or suspicious activity related to Tutor LMS plugin functions.

Specific commands or detection methods are not provided in the available resources. However, network or system administrators should look for unusual requests to Tutor LMS plugin endpoints or audit user actions with subscriber-level privileges attempting to perform higher-privileged operations.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update the Tutor LMS WordPress plugin to version 3.9.6 or later, where the vulnerability has been patched.

Until the update can be applied, users of Patchstack can enable an automatic mitigation rule that blocks attacks targeting this vulnerability.

Additionally, enabling auto-updates specifically for vulnerable plugins can help ensure rapid protection against exploitation.

Useful 0 Not Useful 0