{"id":"CVE-2026-92715","kind":"vulnerability","aliases":["CVE-2026-92715"],"related":[],"title":"Tutor LMS WordPress plugin: authors can overwrite other instructors' courses","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.","summary":"Tutor LMS for WordPress through version 4.1.0 fails to validate a user-supplied ID parameter when saving courses. An authenticated author can overwrite the title, content and status of other instructors' courses and take ownership of them.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elearning","package","tutor-lms","wordpress"],"not_affected_if":["no-author-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Tutor LMS version in the WordPress plugins screen or with `wp plugin get tutor --field=version`\n- Check whether any user has the author role, since author-level access is required","fix":"- Update Tutor LMS to a version later than `4.1.0`, as listed by the plugin vendor (fixed version unknown from the sources)\n- Until updated, restrict or review accounts with the author role","status":"open","published_at":"2026-10-17T04:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:39:54+00:00","updated_at":"2026-10-25T04:39:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:39:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update Tutor LMS to a version later than `4.1.0`, as listed by the plugin vendor (fixed version unknown from the sources)\n- Until updated, restrict or review accounts with the author role","reach":"internet","title":"Tutor LMS WordPress plugin: authors can overwrite other instructors' courses","impact":"medium","summary":"Tutor LMS for WordPress through version 4.1.0 fails to validate a user-supplied ID parameter when saving courses. An authenticated author can overwrite the title, content and status of other instructors' courses and take ownership of them.","category":"package","nicknames":[],"who_cares":["wordpress","tutor-lms","elearning"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker overwrites other instructors' courses and takes ownership","analyst_note":"","how_to_check":"- Check the installed Tutor LMS version in the WordPress plugins screen or with `wp plugin get tutor --field=version`\n- Check whether any user has the author role, since author-level access is required","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running Tutor LMS up to and including 4.1.0 where authors or higher can create courses. Exposure depends on the author-level accounts that exist, so sites with only administrators and subscribers are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3463,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92715':13A,16A '4.1.0':29B,84C 'access':109C 'arbitrari':114C 'argument':165C 'array':140C,166C 'attack':104C,143C 'attacker-suppli':142C 'authent':43B,103C 'author':5A,44B,107C 'author-level':106C 'content':49B,123C 'control':96C 'cours':10A,41B,55B,65C,115C,131C 'creat':116C 'cve':11A,14A 'direct':74C 'due':89C 'elearn':17B,62C 'empti':158C 'exist':172C 'fail':30B 'id':37B,87C,148C,159C 'includ':83C,147C 'input':138C 'insecur':73C 'insert':163C,178C 'instructor':9A,54B,119C 'interpret':154C 'key':97C,146C 'level':108C 'lms':2A,21B,24B,61C 'make':99C 'miss':91C 'modifi':113C 'new':177C 'non':157C 'non-empti':156C 'object':75C 'onlin':64C 'overwrit':7A,46B,120C 'ownership':58B,128C 'packag':18B 'paramet':38B,88C 'plugin':4A,67C 'possibl':101C,136C 'post':145C,164C,173C 'preserv':141C 'rather':174C 'reassign':127C 'refer':76C 'sanit':139C 'save':40B 'solut':66C 'status':51B,125C 'strip':150C 'suppli':36B,144C 'take':57B 'titl':48B,122C 'tutor':1A,20B,23B,60C 'tutor-lm':19B 'updat':169C 'user':35B,95C 'user-suppli':34B 'valid':32B,92C 'version':28B,79C 'via':85C 'vulner':71C 'without':149C 'wordpress':3A,22B,26B,69C,153C 'wp':162C","nicknames":[],"mitigations":[],"who_affected":"Sites running Tutor LMS up to and including 4.1.0 where authors or higher can create courses. Exposure depends on the author-level accounts that exist, so sites with only administrators and subscribers are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92715","severity":null,"published_at":"2026-10-17T04:17:10+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}