CVE-2026-18439
Received Received - Intake

Insecure Direct Object Reference in Tutor LMS WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-18439
EUVD
EUVD-2026-84301

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tutor_lms tutor_lms to 4.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Tutor LMS WordPress plugin. It allows authenticated attackers with Instructor-level access or higher to modify or delete quiz questions and answers belonging to other users by exploiting missing validation on nested identifiers like question_id and answer_id. The plugin fails to verify if these nested values belong to a quiz or course the attacker is authorized to manage.

Detection Guidance

To detect this vulnerability, check WordPress sites running Tutor LMS versions up to 4.0.7 for unauthorized modifications to quiz questions or answers. Inspect server logs for AJAX requests to tutor_quiz_builder_save with nested parameters like question_id, answer_id, deleted_question_ids[], or deleted_answer_ids[]. Look for requests where the top-level course_id or topic_id does not match the user's authorized scope.

Impact Analysis

If you use the Tutor LMS plugin with Instructor or higher privileges, an attacker could alter or delete your quizzes and answers without permission. This could disrupt courses, change content, or remove important assessments. Even users with lower privileges might be affected if their content is modified by higher-privileged attackers.

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of sensitive training data, potentially violating GDPR (data integrity) or HIPAA (protected health information integrity). If quiz content or user data is altered without consent, it may result in non-compliance with these regulations.

Mitigation Strategies

Update the Tutor LMS plugin to the latest version immediately to patch the insecure direct object reference vulnerability. If an update is not available, consider disabling the plugin temporarily until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart