PT-2026-6043 · WordPress · Tutor Lms

Athiwat Tiprasaharn

+1

·

Published

2026-02-03

·

Updated

2026-02-03

·

CVE-2026-1375

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.5
Description The Tutor LMS plugin for WordPress is susceptible to Insecure Direct Object References (IDOR) due to insufficient object-level authorization checks. Specifically, the course list bulk action(), bulk delete course(), and update course status() functions lack proper validation. This allows authenticated attackers with Tutor Instructor-level access or higher to modify or delete courses they do not own by manipulating course IDs in bulk action requests. The vulnerable parameter is the course ID used in bulk action requests.
Recommendations Update Tutor LMS to a version later than 3.9.5. As a temporary workaround, restrict access to the course list bulk action(), bulk delete course(), and update course status() functions for users with Tutor Instructor-level access or higher.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1375

Affected Products

Tutor Lms