CVE-2026-93779 Details
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Tutor LMS WordPress plugin, affecting all versions through 4.1.2. The issue arises in the init_routes function, where user-controlled keys lack proper validation. This vulnerability enables authenticated attackers with subscriber-level access or higher to access paid course content, including lessons and topics, without enrollment. Additionally, attackers can retrieve quiz answer keys, including the 'is_correct' field, before taking a quiz. The vulnerability also allows enumeration of email addresses, usernames, and registration details of other users, including instructors and administrators. Exploitation requires a valid Tutor LMS API key and secret, which are provided to subscriber-level users through the plugin's API key management feature.
Users are advised to update Tutor LMS to version 4.1.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026CISA-ADP
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tutor LMS | <= 4.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2026 | New CVE Received | [email protected] |