PT-2026-6043 · WordPress · Tutor Lms

Athiwat Tiprasaharn

+1

·

Publicado

2026-02-03

·

Atualizado

2026-02-03

·

CVE-2026-1375

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.5
Description The Tutor LMS plugin for WordPress is susceptible to Insecure Direct Object References (IDOR) due to insufficient object-level authorization checks. Specifically, the course list bulk action(), bulk delete course(), and update course status() functions lack proper validation. This allows authenticated attackers with Tutor Instructor-level access or higher to modify or delete courses they do not own by manipulating course IDs in bulk action requests. The vulnerable parameter is the course ID used in bulk action requests.
Recommendations Update Tutor LMS to a version later than 3.9.5. As a temporary workaround, restrict access to the course list bulk action(), bulk delete course(), and update course status() functions for users with Tutor Instructor-level access or higher.

Correção

IDOR

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1375

Produtos afetados

Tutor Lms