What the vulnerability does
01Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
Explanation of Vulnerability in Simple Terms
02Summary
Tutor LMS versions up to 3.9.5 contain an authorization flaw that allows authenticated users to modify or delete course data and settings they should not have access to. The vulnerability requires a valid user account but no special privileges. An attacker can alter course content, disable courses, or corrupt course availability without the site owner's knowledge.
What an attacker can do
03Attacker Capabilities
Modify or delete course data and settings as an authenticated user without proper authorization.
Potential impact on your site
04Site Impact
Course instructors or students could have their courses altered, deleted, or made unavailable by other authenticated users.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site; no special privileges required.
Key dates
06Disclosure timeline
February 3, 2026
CVE published
April 8, 2026
Record updated
