# Tutor LMS <= 4.2.0 - Authenticated (Tutor Instructor+) Insecure Direct Object Reference to Limited Post Modification and Deletion via Announcement ID

- **ID:** WPSEC-2026-2835
- **Plugin:** Tutor LMS – eLearning and online course solution (`tutor`), https://wordpress.org/plugins/tutor/
- **Affected versions:** all versions before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tutor
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2835/

## Description

The Tutor LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'announcement_id' and 'bulk-ids' parameters of the announcement save, delete and bulk delete AJAX actions in all versions up to, and including, 4.2.0. This is due to the handlers authorizing the supplied ID only by checking that its parent post is a course the user instructs, without verifying that the ID is an announcement. This makes it possible for authenticated attackers with Tutor instructor-level access to overwrite or delete posts that are not announcements but whose parent is one of their courses, such as enrollment records, attachments and meeting posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2835/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2835/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.