CVE-2026-1375: Tutor LMS Auth Bypass Vulnerability

CVE-2026-1375 Overview

The Tutor LMS – eLearning and online course solution plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability affecting all versions up to and including 3.9.5. This vulnerability stems from missing object-level authorization checks in the course_list_bulk_action(), bulk_delete_course(), and update_course_status() functions within the Course_List.php class. Authenticated attackers with Tutor Instructor-level access and above can exploit this flaw to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.

Critical Impact

Authenticated attackers with instructor privileges can modify or delete any course on the platform, potentially disrupting educational content delivery and causing significant data loss for course creators.

Affected Products

• Tutor LMS WordPress Plugin versions up to and including 3.9.5
• WordPress sites using vulnerable Tutor LMS installations
• eLearning platforms built on affected Tutor LMS versions

Discovery Timeline

• 2026-02-03 - CVE CVE-2026-1375 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-1375

Vulnerability Analysis

This Insecure Direct Object Reference (IDOR) vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability allows authenticated users with Tutor Instructor privileges to perform unauthorized operations on courses owned by other users.

The core issue lies in the plugin's failure to verify that the authenticated user has proper ownership or administrative rights over the courses being manipulated during bulk operations. When processing bulk action requests, the plugin accepts course IDs from user input without validating whether the requesting user has authorization to perform actions on those specific courses.

This authorization gap enables horizontal privilege escalation, where an instructor can affect resources belonging to other instructors at the same privilege level, as well as potentially impact courses owned by administrators.

Root Cause

The root cause of this vulnerability is the absence of object-level authorization checks in three critical functions within the Course_List.php class:

1. course_list_bulk_action() - Handles bulk operations on courses without verifying course ownership
2. bulk_delete_course() - Processes mass course deletions without validating user authorization for each course ID
3. update_course_status() - Updates course status without confirming the user owns or has permission to modify the target courses

The plugin relies solely on role-based authentication (checking if the user is an instructor) rather than implementing proper object-level authorization that verifies the relationship between the authenticated user and the specific resources being accessed.

Attack Vector

The attack can be executed over the network by any authenticated user with Tutor Instructor-level privileges or higher. The exploitation requires no user interaction and has low attack complexity.

An attacker would craft malicious HTTP requests to the WordPress admin-ajax endpoint or relevant form submissions, including course IDs belonging to other users in the bulk action parameters. The vulnerable functions process these IDs without ownership verification, executing the requested operations (modification or deletion) on courses the attacker does not own.

The attack flow involves intercepting legitimate bulk action requests, modifying the course ID parameters to include target course IDs, and submitting the manipulated request. Technical details of the vulnerable code can be found in the WordPress Tutor Course_List Code at Line 289, Line 437, and Line 463.

Detection Methods for CVE-2026-1375

Indicators of Compromise

• Unusual bulk course deletion or modification activities in WordPress audit logs attributed to instructor accounts
• Courses being modified or deleted by users who are not the original course creators
• Unexpected changes to course status (draft, published, archived) across multiple courses owned by different instructors
• Spike in admin-ajax requests containing bulk action parameters from instructor-level accounts

Detection Strategies

• Monitor WordPress activity logs for bulk course operations performed by instructors on courses they do not own
• Implement database-level auditing to track course table modifications and correlate with the authenticated user performing the action
• Deploy web application firewall (WAF) rules to flag requests containing unusual patterns of course IDs in bulk action parameters
• Review access logs for repeated bulk action requests from single instructor accounts

Monitoring Recommendations

• Enable detailed WordPress audit logging with a plugin that tracks course-level changes and user associations
• Configure alerts for bulk operations affecting courses owned by multiple different users in a single request
• Implement real-time monitoring of the Course_List.php endpoint activity
• Establish baseline metrics for normal instructor bulk operation patterns to identify anomalies

How to Mitigate CVE-2026-1375

Immediate Actions Required

• Update Tutor LMS plugin to a version newer than 3.9.5 that contains the security patch
• Review WordPress user accounts with instructor privileges and audit recent activity
• Check course audit logs for any unauthorized modifications or deletions
• Consider temporarily restricting bulk action capabilities for instructor-level users until patching is complete

Patch Information

The vulnerability has been addressed in versions after 3.9.5. The patch implements proper object-level authorization checks in the affected functions. Details of the fix can be reviewed in the WordPress Tutor Changeset Report.

For additional vulnerability details and analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Implement a custom WordPress capability check plugin that validates course ownership before allowing bulk operations
• Use a security plugin like Wordfence to monitor and block suspicious bulk action requests
• Temporarily revoke bulk action capabilities from instructor roles by modifying role capabilities through a plugin or custom code
• Enable WordPress application-level logging to detect and respond to exploitation attempts

# Verify current Tutor LMS version and update via WP-CLI
wp plugin list --name=tutor --fields=name,version
wp plugin update tutor --version=latest
wp cache flush