CVE-2026-88944

Overview

An authorization bypass vulnerability exists in the Tutor LMS plugin for WordPress up to version 4.0.8 due to improper access controls. Authenticated attackers with subscriber-level privileges can exploit this flaw to permanently delete arbitrary posts, pages, courses, and products. This compromises data integrity and availability across the affected WordPress site.

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.

Impact

The vulnerability primarily impacts data integrity and availability, allowing low-privileged users to permanently destroy critical site content such as courses, quizzes, and WooCommerce items. Confidentiality is not directly affected, but operational disruption can be severe. The impact is restricted to WordPress installations running vulnerable versions of the Tutor LMS plugin.

Remediation

Update the Tutor LMS plugin to the latest patched version provided by the vendor. Restrict low-privileged user account creation (such as subscriber roles) if open registration is not required. Monitor file upload and post deletion logs for unusual administrative activity.

Risk context

This vulnerability is rated as medium severity with a CVSS v3 score of 4.3. The current EPSS score is 0.0028, indicating a low immediate probability of exploitation in the wild, but defenders should still prioritize patching due to the potential for disruptive data loss.

Affected products

• WordPress Tutor LMS plugin