Executive brief
Tutor LMS is a popular WordPress plugin used to create and manage online courses. A security flaw allows any logged-in user, such as a student, to modify the structure of courses they do not own. This means an unauthorized person could reorder lessons, detach content from topics, or move lessons between different courses, potentially disrupting the learning experience and damaging the integrity of educational content.
Technical details
The vulnerability is classified as an Insecure Direct Object Reference (IDOR) within the `tutor_update_course_content_order` AJAX handler. While some branches of the handler implement capability checks, the `save_course_content_order()` private method is called unconditionally and fails to verify if the requesting user has ownership or management permissions for the affected course. An authenticated attacker with Subscriber-level permissions or higher can submit a crafted AJAX request containing a `tutor_topics_lessons_sorting` JSON payload. This allows them to reorder course content, detach lessons from topics, or reassign lessons to different topics across any course on the site, including those owned by administrators. The issue is addressed in version 3.9.8.
Affected products
- Themeum Tutor LMS Up to and including 3.9.7
Timeline
- 2026-04-11: disclosed
- 2026-04-11: advisory
- 2026-04-11: patched: Fixed in version 3.9.8
References
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ftutor/tags/3.9.8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cf0430-8577-449a-aefe-d7bf606fe2de?source=cve