Authorization Bypass in Tutor LMS eLearning Plugin for WordPress

CVE-2026-88944

What is CVE-2026-88944?

The Tutor LMS plugin for WordPress contains a vulnerability that allows unauthorized users to bypass authorization checks. This flaw enables authenticated attackers with subscriber-level access or higher to permanently delete any WordPress content, including posts, pages, courses, quizzes, and WooCommerce products. The attacker must first manipulate the profile-photo upload process to create an authored attachment, which is then exploited to delete arbitrary content through the lesson deletion handler, presenting a significant security risk for users of the affected plugin.

References