Live › vulnerability › CVE-2026-92715
Go to dashboardTutor LMS for WordPress through version 4.1.0 fails to validate a user-supplied ID parameter when saving courses. An authenticated author can overwrite the title, content and status of other instructors' courses and take ownership of them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Tutor LMS up to and including 4.1.0 where authors or higher can create courses. Exposure depends on the author-level accounts that exist, so sites with only administrators and subscribers are less exposed.
No product ranges from the sources yet.
wp plugin get tutor --field=version4.1.0, as listed by the plugin vendor (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
This page as .md · .json · in your agent: get_signal("CVE-2026-92715")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.