Executive brief
Tutor LMS is a popular WordPress plugin used to create and manage online courses. A security flaw allows users with instructor-level accounts to modify or delete content belonging to other instructors, such as lessons, quizzes, and student grades. This could lead to significant data loss, unauthorized content changes, and disruption of educational services.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Tutor LMS due to the `get_course_id_by()` function trusting a user-supplied `course` GET parameter. This parameter is used by the `can_user_manage()` function to verify authorization. Because the plugin checks permissions against the attacker-supplied ID rather than the actual owner of the target object, authenticated attackers with instructor-level privileges can perform unauthorized actions. These actions include deleting lessons, assignments, and quizzes (including student data), modifying course content, and viewing unpublished materials across different instructor accounts.
Affected products
- Themeum Tutor LMS up to and including 3.9.9
Timeline
- 2026-05-13: disclosed
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Announcements.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Lesson.php