# CVE-2026-57694: Themeum Tutor LMS IDOR authorization bypass

Source: https://junglewise.ai/threats/cve-2026-57694-themeum-tutor-lms-idor-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57694 · Severity: medium · CVSS 6.5 · Published 2026-07-13

Themeum Tutor LMS, a popular learning management system for WordPress, contains a security flaw that allows users with low-level accounts to bypass intended access controls. By manipulating specific identifiers in web requests, an unauthorized user could potentially modify data or interact with system components they should not have access to. This could lead to unauthorized changes to course content or student records, impacting the integrity of the educational platform.

Technologies: [Themeum Tutor LMS](https://junglewise.ai/threats/technologies/tutor-lms). Vendors: [Themeum](https://junglewise.ai/threats/vendors/themeum).

## Quick answers

**Is CVE-2026-57694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57694 being exploited in the wild.

**How severe is CVE-2026-57694?** Medium severity, with a CVSS score of 6.5, published 13 July 2026.

**Which products and versions are affected?** Themeum Tutor LMS <= 3.9.13.

**Is there a fix for CVE-2026-57694?** A patch was published on 2026-07-13: Version 3.9.14 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57694 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57694?** Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Themeum Tutor LMS due to an authorization bypass through a user-controlled key. The application fails to properly validate if the authenticated user has the necessary permissions to access or modify a specific object identified by a request parameter. A remote attacker with at least Subscriber-level privileges can exploit this by manipulating these keys to interact with incorrectly configured access control security levels. This allows for unauthorized data modification (Integrity: High) but does not directly facilitate data exfiltration or service disruption according to the CVSS vector. The issue is resolved in version 3.9.14.

## Affected products

- Themeum Tutor LMS <= 3.9.13

## Timeline

- 2026-03-21: disclosed: Reported by TristanInSec
- 2026-07-06: advisory: Patchstack advisory published
- 2026-07-13: advisory: NVD published CVE-2026-57694
- 2026-07-13: patched: Version 3.9.14 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-13-insecure-direct-object-references-idor-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-13-insecure-direct-object-references-idor-vulnerability?_s_id=cve)

## Related threats

- [Tutor LMS insecure direct object reference in API routing](https://junglewise.ai/threats/cve-2026-93779-the-tutor-lms-elearning-and-online-course-solution-plugin-for)
- [Themeum Tutor LMS stored cross-site scripting](https://junglewise.ai/threats/cve-2026-111407-improper-neutralization-of-input-during-web-page-generation)
- [Tutor LMS insecure direct object reference in course update](https://junglewise.ai/threats/cve-2026-92715-the-tutor-lms-elearning-and-online-course-solution-plugin-for)
- [Tutor LMS stored cross-site scripting via display_name](https://junglewise.ai/threats/cve-2026-93681-the-tutor-lms-elearning-and-online-course-solution-plugin-for)
- [Themeum Tutor LMS reflected cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-42702-improper-neutralization-of-input-during-web-page-generation-cross)