CVE-2026-89333: Tutor LMS Information Disclosure Vulnerability

CVE-2026-89333 Overview

CVE-2026-89333 is an Insecure Direct Object Reference (IDOR) vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 4.0.8. The plugin fails to validate a user-controlled student_id parameter, allowing authenticated attackers with subscriber-level access or higher to enumerate arbitrary user IDs. Successful exploitation discloses the email address and Tutor profile phone number of any WordPress user, including Administrators. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any low-privileged authenticated user can harvest email addresses and phone numbers of administrators and other WordPress accounts, enabling targeted phishing and account takeover preparation.

Affected Products

Tutor LMS – eLearning and online course solution plugin for WordPress
All plugin versions up to and including 4.0.8
WordPress installations exposing Tutor LMS user profile endpoints to subscriber-level accounts

Discovery Timeline

2026-09-19 - CVE-2026-89333 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-89333

Vulnerability Analysis

The vulnerability resides in the Tutor LMS user profile rendering path. Server-side code accepts a student_id value supplied through a request parameter and uses it directly to look up user profile data. No ownership check or capability verification is performed against the authenticated caller. As a result, an attacker holding a subscriber account can iterate numeric user IDs and retrieve profile fields belonging to other accounts. Referenced code paths include classes/Template.php, classes/Utils.php, and templates/user-profile.php in the Tutor 4.0.8 source tree.

Root Cause

The root cause is missing authorization enforcement on a user-controlled key. The plugin trusts the client-supplied student_id to identify the profile subject rather than deriving it from the current session. Because WordPress user IDs are sequential integers, an attacker can trivially enumerate the entire user table. Sensitive fields exposed include the WordPress account email address and the phone number stored on the Tutor profile.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at subscriber level or above. Registration is often open on sites that use Tutor LMS to onboard learners, which lowers the barrier to obtaining that access. Once authenticated, the attacker issues requests to the user-profile endpoint while incrementing the student_id parameter, collecting the returned personal data. See the Wordfence vulnerability report for additional context.

// No verified exploitation code is published. The vulnerability is exercised
// by manipulating the student_id parameter on the Tutor user profile route
// while authenticated as a subscriber, then iterating numeric IDs.

Detection Methods for CVE-2026-89333

Indicators of Compromise

Repeated authenticated HTTP requests to Tutor LMS user profile URLs with sequentially incrementing student_id values from the same session or IP.
Subscriber accounts generating volumes of profile-view traffic inconsistent with normal learner behavior.
Newly registered subscriber accounts issuing profile lookups within minutes of registration.

Detection Strategies

Parse web server access logs for query strings containing student_id= and group by session cookie or user ID to identify enumeration patterns.
Alert when a single authenticated session requests more than a threshold of distinct student_id values within a short window.
Correlate WordPress authentication logs with profile-endpoint request counts to flag low-privilege accounts touching many user records.

Monitoring Recommendations

Enable verbose logging on the Tutor LMS routes referenced in templates/user-profile.php and forward logs to a centralized analytics platform.
Track outbound email volumes to addresses recently disclosed through profile lookups to detect follow-on phishing.
Monitor for anomalous account registrations followed by rapid API traversal of user IDs.

How to Mitigate CVE-2026-89333

Immediate Actions Required

Update the Tutor LMS plugin to a version later than 4.0.8 that incorporates the fix referenced in changeset 3700174.
Audit WordPress user accounts and disable inactive or unrecognized subscriber accounts.
Review web server logs for prior enumeration activity against the Tutor user profile endpoints.

Patch Information

The vendor addressed the issue in the changeset published on the WordPress plugin repository. Site operators should install the patched release through the WordPress admin dashboard or via wp-cli. Refer to the Wordfence advisory for confirmation of the fixed version.

Workarounds

Disable open user registration on the WordPress site to remove the primary path to subscriber-level access.
Restrict access to Tutor user profile routes with a web application firewall rule that blocks unauthenticated iteration of student_id.
Temporarily deactivate the Tutor LMS plugin on sites that cannot patch immediately and do not depend on it for active courses.

bash

# Update Tutor LMS via wp-cli to a patched release
wp plugin update tutor
wp plugin get tutor --field=version