CVE-2026-89333

Received Received - Intake

Insecure Direct Object Reference in Tutor LMS WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-89333

Affected Vendors & Products

Vendor	Product	Version / Range
tutor_lms	tutor_lms	to 4.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Tutor LMS WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to view sensitive user information like email addresses and phone numbers by manipulating the 'student_id' parameter without proper validation.

Detection Guidance

This vulnerability can be detected by checking for unauthorized access to user data via the 'student_id' parameter in Tutor LMS plugin requests. Monitor WordPress logs for repeated requests to endpoints like /wp-json/tutor/v1/students/ with varying student_id values. Use tools like Wireshark or tcpdump to inspect HTTP traffic for suspicious patterns targeting the plugin.

Impact Analysis

If you use the Tutor LMS plugin, attackers could access private user data such as email addresses and phone numbers of any WordPress user, including administrators. This could lead to privacy breaches, phishing attacks, or further exploitation of user accounts.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing personally identifiable information (PII) without authorization. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage due to unauthorized data disclosure.

Mitigation Strategies

Immediately update the Tutor LMS plugin to the latest version beyond 4.0.8. If an update is unavailable, disable the plugin temporarily. Restrict subscriber-level access to sensitive endpoints and review user permissions. Implement rate limiting on API endpoints to prevent brute-force enumeration of user IDs.

Hi! I’m here to help you understand CVE-2026-89333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70