What the vulnerability does
01Description
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Explanation of Vulnerability in Simple Terms
02Summary
Tutor LMS Pro versions up to 3.8.3 contain an improper access control vulnerability that allows authenticated users to read and modify sensitive data they should not have access to. An attacker with a low-privilege account can view or alter information belonging to other users or the site. The vulnerability requires an active user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Read and modify data belonging to other users or restricted site information.
Potential impact on your site
04Site Impact
User data and site information may be exposed to or modified by low-privilege account holders.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site; no special privileges required.
Key dates
06Disclosure timeline
October 25, 2025
CVE published
April 8, 2026
Record updated
