Unauthorized Post Reassignment in Tutor LMS by Edwiser
CVE-2026-85571
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-85571?
The Tutor LMS plugin for WordPress, prior to version 4.1.1, exhibits improper access control by failing to verify the ownership of posts during course content ordering requests. This flaw permits users with instructor-level permissions to reassign course materials belonging to other instructors. Consequently, this could lead to unauthorized manipulation of course content, making it difficult for legitimate users to access their materials and manage their courses effectively.
Affected Version(s)
Tutor LMS 4.0.5 < 4.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.