# CVE-2026-85571: Tutor LMS WordPress plugin arbitrary post reparenting via IDOR

Source: https://junglewise.ai/threats/cve-2026-85571-the-tutor-lms-wordpress-plugin-before-4-1-1-does-not-verify-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-85571 · Severity: medium · CVSS 6.5 · Published 2026-10-10

Tutor LMS is a WordPress plugin that manages online courses and educational content. Before version 4.1.1, the plugin fails to verify that course content reorganization requests only affect courses the requester owns, allowing instructors to hijack other instructors' course content and reassign any published post on the site to their own courses. This enables course content theft and makes legitimate content unreachable.

Technologies: [Tutor LMS](https://junglewise.ai/threats/technologies/tutor-tutor-lms). Vendors: [Tutor](https://junglewise.ai/threats/vendors/tutor).

## Quick answers

**Is CVE-2026-85571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85571 being exploited in the wild.

**How severe is CVE-2026-85571?** Medium severity, with a CVSS score of 6.5, published 10 October 2026.

**Which products and versions are affected?** Tutor LMS 4.0.5 to 4.1.0.

**Is there a fix for CVE-2026-85571?** Yes: fixed in 4.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85571 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85571?** Check whether you run Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.1

## Technical details

The plugin implements insecure direct object reference (IDOR) in course content ordering functionality, lacking authorization checks to verify the target post belongs to a course managed by the requesting instructor. An authenticated instructor can craft requests to reassign the parent post of any content on the site, taking ownership of other instructors' course materials. The vulnerability is fixed in version 4.1.1.

## Affected products

- Tutor Tutor LMS 4.0.5 to 4.1.0

## Timeline

- 2026-10-08: disclosed
- 2026-10-10: advisory

## References

- [https://wpscan.com/vulnerability/3c4ce27a-527a-416f-b1c8-d40ca5f65974/](https://wpscan.com/vulnerability/3c4ce27a-527a-416f-b1c8-d40ca5f65974/)

## Related threats

- [Tutor LMS WordPress plugin quiz answer disclosure](https://junglewise.ai/threats/cve-2026-85570-the-tutor-lms-wordpress-plugin-before-4-2-0-does-not-prevent-the)
- [Tutor LMS DOM-based XSS in redirect_url parameter](https://junglewise.ai/threats/cve-2026-88963-the-tutor-lms-elearning-and-online-course-solution-plugin-for)