Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter

Wordfence Intelligence > Vulnerability Database > Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter

5.3

Authorization Bypass Through User-Controlled Key

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE	CVE-2026-6965
CVSS	5.3 (Medium)
Publicly Published	May 12, 2026
Last Updated	May 13, 2026
Researcher	molten bit

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.

References

Vulnerability Details for Tutor LMS – eLearning and online course solution

Tutor LMS – eLearning and online course solution

Software Type	Plugin
Software Slug	tutor (view on wordpress.org)
Patched?	Yes
Remediation	Update to version 3.9.10, or a newer patched version
Affected Version	<= 3.9.9
Patched Version	3.9.10

Recent vulnerabilities in Tutor LMS – eLearning and online course solution

Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

6.4

CVE-2026-13443

Jun 30, 2026

Researcher: skyv3il

Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter

4.9

CVE-2026-10736

Jun 17, 2026

Researcher: s1kr10s

Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization

5.3

CVE-2026-40743

Apr 20, 2026

Researcher: lagi bljr

Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter

6.5

CVE-2026-6080

Apr 16, 2026

Researcher: PRISM

Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order

5.3

CVE-2026-5502

Apr 16, 2026

Researcher: momopon1415

Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification

4.3

CVE-2026-3371

Apr 10, 2026

Researcher: Hunter Jensen (skid)

Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment

5.4

CVE-2026-3358

Apr 10, 2026

Researcher: Mohammad Amin Hajian (mamadrce)

Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter

7.5

CVE-2026-3360

Apr 9, 2026

Researcher: Supakiad S. (m3ez)

Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVE-2025-32223

Mar 16, 2026

Researcher: daroo

Tutor LMS <= 3.9.7 - Missing Authorization

4.3

CVE-2026-40740

Mar 15, 2026

Researcher: 3diklab

#	Title	CVE ID	CVSS	Researchers	Date
1	Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title	CVE-2026-13443	6.4	skyv3il	June 30, 2026
2	Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter	CVE-2026-10736	4.9	s1kr10s	June 17, 2026
3	Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization	CVE-2026-40743	5.3	lagi bljr	April 20, 2026
4	Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter	CVE-2026-6080	6.5	PRISM	April 16, 2026
5	Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order	CVE-2026-5502	5.3	momopon1415	April 16, 2026
6	Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification	CVE-2026-3371	4.3	Hunter Jensen (skid)	April 10, 2026
7	Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment	CVE-2026-3358	5.4	Mohammad Amin Hajian (mamadrce)	April 10, 2026
8	Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter	CVE-2026-3360	7.5	Supakiad S. (m3ez)	April 9, 2026
9	Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference	CVE-2025-32223	4.3	daroo	March 16, 2026
10	Tutor LMS <= 3.9.7 - Missing Authorization	CVE-2026-40740	4.3	3diklab	March 15, 2026

View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation