Insecure Direct Object Reference in Tutor LMS Plugin for WordPress

CVE-2026-18439

What is CVE-2026-18439?

The Tutor LMS plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability in versions up to 4.0.7. This issue arises during the 'tutor_quiz_builder_save' AJAX action, where the lack of proper validation allows authenticated users, especially those with Instructor-level access, to manipulate data that should be restricted. Specifically, it allows unauthorized modifications to quiz questions and answers that belong to other users, as the code only performs validation for top-level identifiers like course_id and topic_id. This oversight poses a significant risk, enabling attackers to overwrite content or delete quiz-related entries belonging to other instructors or administrators.

References