Tutor LMS <= 4.2.0 - Authenticated (Tutor Instructor+) Insecure Direct Object Reference to Limited Post Modification and Deletion via Announcement ID
- ID
- WPSEC-2026-2835
- Plugin
- Tutor LMS – eLearning and online course solution (tutor)
- Affected
- all versions before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Tutor LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Tutor LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'announcement_id' and 'bulk-ids' parameters of the announcement save, delete and bulk delete AJAX actions in all versions up to, and including, 4.2.0. This is due to the handlers authorizing the supplied ID only by checking that its parent post is a course the user instructs, without verifying that the ID is an announcement. This makes it possible for authenticated attackers with Tutor instructor-level access to overwrite or delete posts that are not announcements but whose parent is one of their courses, such as enrollment records, attachments and meeting posts.
References
- https://wpsec.com/vuln/WPSEC-2026-2835/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS