CVE-2026-85571
Received Received - Intake

Tutor LMS Post Reassignment Vulnerability

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: WPScan

Description
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-85571
EUVD
EUVD-2026-96129

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Tutor LMS 4.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Tutor LMS WordPress plugin versions 4.0.5 to 4.1.0. It allows users with instructor-level access to reassign the parent of any post on the site, including moving other instructors' course content into their own courses. This can make published content unreachable and disrupt course management.

Detection Guidance

Check if your Tutor LMS plugin version is between 4.0.5 and 4.1.0. Inspect WordPress logs for unusual post parent reassignment events or unauthorized course content modifications.

Impact Analysis

If you are an instructor using Tutor LMS versions 4.0.5 to 4.1.0, another instructor could take control of your course content by moving it into their courses. This could lead to loss of access to your content, disruption of your courses, and potential data integrity issues.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to or modification of sensitive data, such as course content containing personal or protected information. This may violate data integrity and access control requirements under GDPR, HIPAA, or other regulations.

Mitigation Strategies

Update Tutor LMS to version 4.1.1 or later immediately. Review and audit course content ownership to identify any unauthorized reassignments. Restrict instructor-level access to only necessary users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart