CVE-2026-92715 Details
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Tutor LMS WordPress plugin, in all versions through 4.1.0. The vulnerability arises from inadequate validation of user-controlled 'ID' parameters, enabling authenticated attackers with author-level access or higher to alter courses created by other instructors. Exploitation of this vulnerability allows attackers to overwrite course titles, content, and statuses, and to reassign course ownership to themselves. The issue stems from the 'Input::sanitize_array()' function, which fails to remove attacker-supplied POST keys, including 'ID'. WordPress then interprets a non-empty 'ID' as a command to update an existing post, rather than creating a new one.
Users are advised to update the Tutor LMS plugin to version 4.1.1 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tutor LMS | <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |