Executive brief
Tutor LMS is a WordPress plugin that powers online course platforms and learning management systems. An authenticated attacker with instructor-level privileges can modify, delete, or reassign quiz questions and answers belonging to other instructors or administrators by bypassing authorization checks, leading to course content tampering and data loss.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the tutor_quiz_builder_save AJAX action, where the handler validates top-level course_id and topic_id but passes nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] directly into database update and delete operations without verifying ownership. An authenticated attacker with Instructor-level access can craft requests to overwrite quiz questions and answers belonging to other instructors, or delete arbitrary question and answer records via QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete() functions.
Affected products
- Themeum Tutor LMS up to and including 4.0.7
Timeline
- 2026-09-22: disclosed