CVE-2026-85569: Tutor LMS WordPress Auth Bypass Vulnerability

CVE-2026-85569 Overview

CVE-2026-85569 affects the Tutor LMS WordPress plugin in versions prior to 4.0.8. The plugin fails to correctly identify whether an incoming request targets its own REST API endpoints. It also does not enforce the permission scope recorded against an API credential. As a result, an attacker holding a read-only application key can perform actions as the administrator account that issued the credential. This constitutes an improper privilege management flaw tracked under [CWE-269].

Critical Impact
A holder of a read-only Tutor LMS API key can execute administrator-level operations, resulting in full compromise of course data, user accounts, and plugin configuration.

Affected Products

Tutor LMS WordPress plugin versions prior to 4.0.8
WordPress sites exposing the Tutor LMS REST API
Any deployment issuing read-only Tutor LMS application keys from administrator accounts

Discovery Timeline

2026-09-16 - CVE-2026-85569 published to the National Vulnerability Database
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-85569

Vulnerability Analysis

The flaw arises from two compounding defects in Tutor LMS request handling. First, the plugin does not reliably determine whether an inbound request is addressed to its own REST API surface. Second, it does not enforce the permission level bound to the credential presented with the request.

The combined effect is a broken access control condition classified as [CWE-269] Improper Privilege Management. When a request arrives carrying a read-only API key, the plugin fails to constrain the request scope. The credential is treated as belonging to the issuing account, which is typically an administrator, and the request executes with those elevated privileges.

An authenticated attacker holding a low-privilege API key can therefore reach state-changing endpoints reserved for administrators. Exploitation impacts confidentiality, integrity, and availability of the WordPress site and the learning management data it hosts.

Root Cause

The root cause is missing permission enforcement in the plugin's REST API dispatch logic. The plugin conflates authentication (proof of key ownership) with authorization (what that key is permitted to do). Tutor LMS also does not consistently scope requests to its own namespace, weakening any downstream permission checks.

Attack Vector

Exploitation requires an attacker to possess a valid Tutor LMS API application password or key issued by an administrator, even if that key was scoped read-only. The attacker sends crafted HTTP requests to Tutor LMS REST endpoints that perform privileged actions such as user creation, course modification, or configuration change. The plugin accepts the authenticated request and processes it with the administrator's effective privileges. No user interaction is required, and the attack is delivered over the network.

Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-85569

Indicators of Compromise

Unexpected administrator-level actions in WordPress audit logs originating from accounts associated only with read-only API keys.
REST API requests to /wp-json/tutor/* endpoints performing state changes from credentials that should be limited to read operations.
Creation of new administrator or instructor accounts, course modifications, or plugin option changes without a corresponding interactive admin session.

Detection Strategies

Correlate WordPress application password usage with the scope originally granted at issuance and alert on scope mismatches.
Inspect web server logs for POST, PUT, PATCH, or DELETE requests to Tutor LMS REST endpoints authenticated with API keys.
Baseline normal Tutor LMS API traffic patterns and flag requests to administrative endpoints from unusual client IPs or user agents.

Monitoring Recommendations

Enable WordPress and plugin audit logging with retention sufficient for incident review.
Forward WordPress, PHP, and web server logs to a centralized analytics platform for cross-source correlation.
Monitor for changes to the wp_users, wp_usermeta, and Tutor LMS option tables outside expected maintenance windows.

How to Mitigate CVE-2026-85569

Immediate Actions Required

Update Tutor LMS to version 4.0.8 or later on every affected WordPress site.
Revoke and reissue all existing Tutor LMS API application passwords and keys after patching.
Audit administrator accounts and course data for unauthorized changes made prior to remediation.
Restrict administrative REST endpoints at the web server or WAF layer where operationally feasible.

Patch Information

The vendor addressed the issue in Tutor LMS version 4.0.8. Site administrators should upgrade through the WordPress plugin manager or by deploying the updated release directly. Confirm the installed version reports 4.0.8 or higher after upgrade.

Workarounds

Deactivate the Tutor LMS plugin until the patched version can be installed if immediate upgrade is not possible.
Remove all outstanding application passwords issued to administrator accounts to eliminate abusable credentials.
Restrict access to /wp-json/tutor/* routes to trusted IP ranges via web server or WAF rules until patching is complete.

bash

# Example: block Tutor LMS REST endpoints at nginx pending patch
location ~ ^/wp-json/tutor/ {
    allow 10.0.0.0/8;
    deny all;
}