CVE-2026-3371 Details
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions up to and including 3.9.7. The issue is an Insecure Direct Object Reference (IDOR) caused by missing authorization checks in the private method 'save_course_content_order()'. This method is invoked unconditionally by the 'tutor_update_course_content_order' AJAX handler. While the handler includes a management check for users, the 'save_course_content_order()' method processes JSON data related to lesson sorting without verifying user ownership or capabilities. As a result, authenticated attackers with Subscriber-level access or higher can manipulate course content by detaching lessons from topics, reordering lessons, and reassigning them between topics in any course, including those owned by administrators.
Users are advised to update the Tutor LMS plugin to version 3.9.8 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 11, 2026CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tutor LMS | <= 3.9.7 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 11, 2026 | New CVE Received | [email protected] |