Is CVE-2026-57694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57694 being exploited in the wild.

How severe is CVE-2026-57694?

Medium severity, with a CVSS score of 6.5, published 13 July 2026.

Is there a fix for CVE-2026-57694?

A patch was published on 2026-07-13: Version 3.9.14 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57694 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-57694?

Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57694: Themeum Tutor LMS IDOR authorization bypass

CVE-2026-57694 · Severity: medium · CVSS 6.5 · Published 2026-07-13

Themeum Tutor LMS, a popular learning management system for WordPress, contains a security flaw that allows users with low-level accounts to bypass intended access controls. By manipulating specific identifiers in web requests, an unauthorized user could potentially modify data or interact with system components they should not have access to. This could lead to unauthorized changes to course content or student records, impacting the integrity of the educational platform.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-57694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57694 being exploited in the wild.
How severe is CVE-2026-57694?: Medium severity, with a CVSS score of 6.5, published 13 July 2026.
Which products and versions are affected?: Themeum Tutor LMS <= 3.9.13.
Is there a fix for CVE-2026-57694?: A patch was published on 2026-07-13: Version 3.9.14 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57694 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-57694?: Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Themeum Tutor LMS due to an authorization bypass through a user-controlled key. The application fails to properly validate if the authenticated user has the necessary permissions to access or modify a specific object identified by a request parameter. A remote attacker with at least Subscriber-level privileges can exploit this by manipulating these keys to interact with incorrectly configured access control security levels. This allows for unauthorized data modification (Integrity: High) but does not directly facilitate data exfiltration or service disruption according to the CVSS vector. The issue is resolved in version 3.9.14.

Affected products

Themeum Tutor LMS <= 3.9.13

Timeline

2026-03-21: disclosed: Reported by TristanInSec
2026-07-06: advisory: Patchstack advisory published
2026-07-13: advisory: NVD published CVE-2026-57694
2026-07-13: patched: Version 3.9.14 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.