Executive brief
Tutor LMS is a popular WordPress plugin used to create and manage online courses. A security flaw in the plugin allows users with 'instructor' accounts to overwrite and take control of any page or post on the website, including those created by administrators. This could lead to a full website takeover, the defacement of content, or the theft of sensitive information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the content-builder save handlers of the Tutor LMS plugin for WordPress. The application fails to perform proper authorization checks to ensure the requesting user has permission to edit a specific post ID before executing an overwrite operation. Instead, it validates the request against an unrelated identifier. An authenticated attacker with instructor-level privileges can exploit this to modify the content of any post or page, including administrative pages, effectively gaining full control over the site's content. The issue is resolved in version 3.9.13.
Affected products
- Themeum Tutor LMS < 3.9.13
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory
- 2026-07-13: patched: Date of NVD publication; plugin fixed in 3.9.13