medium · CVSS v3 6.5

CVE-2026-93779

The Tutor LMS WordPress plugin up to version 4.1.2 contains an IDOR that allows authenticated users with subscriber-level access to read pai

Overview

The Tutor LMS WordPress plugin up to version 4.1.2 contains an IDOR that allows authenticated users with subscriber-level access to read paid lesson content, quiz answers, and user registration data. The flaw stems from missing validation on a user‑controlled key in init_routes. It enables unauthorized disclosure of sensitive course material and personal information.

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.

Impact

Confidentiality: unauthorized disclosure of paid lesson content, quiz answers, and user data. Integrity: potential for data tampering if attacker modifies content. Availability: no direct impact. Defenders: site administrators, instructors, and subscribers with API access are at risk of data leakage.

Remediation

Update Tutor LMS to version 4.1.3 or later where the IDOR is fixed. If an update is not immediately possible, disable API key generation for subscriber-level users or restrict API key scopes. Additionally, enforce role‑based access checks on init_routes and audit API key usage logs for anomalous activity.

Risk context

Severity medium (CVSS 6.5). No EPSS data available. The vulnerability allows data exposure but does not enable remote code execution, so the risk is moderate. Prompt patching is recommended to prevent information leakage.

Affected products

  • Tutor LMS 4.1.2
  • Tutor LMS 4.1.1
  • Tutor LMS 4.1.0
  • Tutor LMS 4.0.5
  • Tutor LMS 4.0.4
  • Tutor LMS 4.0.3
  • Tutor LMS 4.0.2
  • Tutor LMS 4.0.1

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

IDOR WordPress TutorLMS DataLeak API Medium Confidentiality

← All CVEs

Related CVEs

medium

CVE-2026-118528

The Directorist WordPress plugin (versions <8.11) fails to verify listing ownership before returning metadata via an AJAX action. This flaw lets any authenticated user with Subscriber or higher role read private and unpublished draft listings of other users. The exposed data includes contact information, potentially compromising user privacy.

View analysis

medium

CVE-2026-118204

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with subscriber-level access can inject scripts that run when others view the page. This flaw allows malicious code to execute in the context of site visitors.

View analysis

medium

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_ . (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

View analysis

medium

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/ /, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

View analysis