CVE-2026-1375 PUBLISHED

Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion

Assigner: Wordfence
Reserved: 23.01.2026 Published: 03.02.2026 Updated: 03.02.2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the course_list_bulk_action(), bulk_delete_course(), and update_course_status() functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 8.1

Product Status

Vendor themeum
Product Tutor LMS – eLearning and online course solution
Versions Default: unaffected
  • affected from * to 3.9.5 (incl.)

Credits

  • Athiwat Tiprasaharn finder
  • Tharadol Suksamran finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE