CVE-2026-92715
Received Received - Intake

IDOR Vulnerability in Tutor LMS WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-92715
EUVD
EUVD-2026-103222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeum Tutor LMS – eLearning and online course solution 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tutor LMS plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 4.1.0. It allows authenticated attackers with author-level access or higher to modify courses created by other users by exploiting the 'ID' parameter. The plugin fails to validate user-controlled keys properly, enabling attackers to overwrite course titles, content, status, and change ownership to themselves.

Detection Guidance

Check WordPress installations for the Tutor LMS plugin versions up to 4.1.0. Look for unauthorized course modifications or ownership changes in the database or admin panel. Monitor for POST requests containing the 'ID' parameter with suspicious activity.

Impact Analysis

If you use the Tutor LMS plugin, attackers could gain unauthorized access to your courses and alter their content, titles, or status. They could also take ownership of your courses, potentially disrupting your eLearning platform or stealing intellectual property. This requires the attacker to have at least author-level access to your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized modifications of course content, potentially violating data integrity requirements under GDPR or HIPAA. If personal or sensitive data is altered without authorization, it may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Update the Tutor LMS plugin to the latest version beyond 4.1.0 immediately. Review course ownership and content for unauthorized changes. Restrict author-level access to only trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart