CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
| CWE | CWE-639 |
| Vendor | themeum |
| Product | tutor lms – elearning and online course solution |
| Published | Feb 3, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for themeum tutor lms – elearning and online course solution
Be the first to know when new high vulnerabilities affecting themeum tutor lms – elearning and online course solution are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
themeum / Tutor LMS – eLearning and online course solution
0 ≤ 3.9.5
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/4e95b32b-c050-41eb-8fce-461257420eb6?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.php#L289 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.php#L437 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.php#L463 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/classes/Course_List.php?contextall=1&old=3339576&old_path=%2Ftutor%2Ftrunk%2Fclasses%2FCourse_List.php
Credits
Athiwat Tiprasaharn Tharadol Suksamran