Insecure Direct Object Reference in Tutor LMS - eLearning Plugin by WordPress

CVE-2026-92715

What is CVE-2026-92715?

The Tutor LMS plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to inadequate validation on user-controlled keys. This flaw permits authenticated attackers with author-level access to alter courses created by other instructors. Attackers can overwrite course titles, content, and status, and even reassign ownership of these courses to themselves. This occurs because the Input::sanitize_array() method retains attacker-defined POST keys, including the 'ID' parameter, without proper sanitization, allowing for unauthorized updates of posts within the WP framework.

References