Is CVE-2026-93779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93779 being exploited in the wild.

How severe is CVE-2026-93779?

Medium severity, with a CVSS score of 6.5, published 7 November 2026.

Which products and versions are affected?

Themeum Tutor LMS up to and including 4.1.2.

Is there a fix for CVE-2026-93779?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93779 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93779?

Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93779: Tutor LMS insecure direct object reference in API routing

CVE-2026-93779 · Severity: medium · CVSS 6.5 · Published 2026-11-07

Tutor LMS is a WordPress plugin that enables organizations to deliver online courses and training. Authenticated users with subscriber-level access can bypass course enrollment checks to view paid lesson content, access quiz answer keys, and enumerate other users' personal information including email addresses and registration data without proper authorization.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-93779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93779 being exploited in the wild.
How severe is CVE-2026-93779?: Medium severity, with a CVSS score of 6.5, published 7 November 2026.
Which products and versions are affected?: Themeum Tutor LMS up to and including 4.1.2.
Is there a fix for CVE-2026-93779?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93779 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93779?: Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to validate user-controlled keys in the init_routes REST API endpoint, allowing authenticated subscribers to access protected resources. An attacker must possess a valid API key/secret pair (automatically issued to subscriber accounts) to perform the exploit. The vulnerability enables unauthorized access to course materials, quiz metadata, and user enumeration across the platform.

Affected products

Themeum Tutor LMS up to and including 4.1.2

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.