---
id: "CVE-2026-92715"
kind: "vulnerability"
aliases: ["CVE-2026-92715"]
title: "Tutor LMS WordPress plugin: authors can overwrite other instructors' courses"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elearning", "package", "tutor-lms", "wordpress"]
not_affected_if: ["no-author-accounts", "plugin-not-installed"]
published_at: "2026-10-17T04:17:10+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:39:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92715", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Tutor LMS WordPress plugin: authors can overwrite other instructors' courses

Tutor LMS for WordPress through version 4.1.0 fails to validate a user-supplied ID parameter when saving courses. An authenticated author can overwrite the title, content and status of other instructors' courses and take ownership of them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tutor LMS version in the WordPress plugins screen or with `wp plugin get tutor --field=version`
- Check whether any user has the author role, since author-level access is required

## Fix

- Update Tutor LMS to a version later than `4.1.0`, as listed by the plugin vendor (fixed version unknown from the sources)
- Until updated, restrict or review accounts with the author role

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92715

## From the sources

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_