CVE-2025-47555 LOW

CVE-2025-47555: WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability

Vendor Themeum
Product Tutor LMS
Weakness CWE-639 · IDOR
Published January 22, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.

Explanation of Vulnerability in Simple Terms

02Summary

Tutor LMS versions up to 3.9.4 contain an authorization flaw that allows high-privilege users to read and modify sensitive data. The vulnerability requires administrator-level access and does not affect data availability. A patch version has not been publicly identified.

What an attacker can do

03Attacker Capabilities

Read and modify sensitive data within the LMS if they have admin-level access.

Potential impact on your site

04Site Impact

Admins with compromised credentials could leak or alter course data, user records, or settings.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege (administrator) account on the site.

Key dates

06Disclosure timeline

January 22, 2026 CVE published
April 28, 2026 Record updated