Back
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
- 5.3MediumCVSS base score
- 0.30%Exploitation in 30 daysEPSS · top 77% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
Timeline
ID reserved
By Wordfence
- 19 days later
· 19 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Affected products
themeum · Tutor LMS – eLearning and online course solution
- affected ≤ 3.9.9
References
References53
- https://www.wordfence.com/threat-intel/vulnerabilities/id/55924ea3-373c-4297-a958-5670def1f6c0?source=cve (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Utils.php#L7829 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Utils.php#L7829 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Utils.php#L8020 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Utils.php#L8020 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Lesson.php#L341 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Lesson.php#L341 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L1041 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Quiz.php#L1041 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L2045 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Course.php#L2045 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Ajax.php#L586 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Ajax.php#L586 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Announcements.php#L105 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Announcements.php#L105 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Q_And_A.php#L219 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Q_And_A.php#L219 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Q_And_A.php#L297 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Q_And_A.php#L297 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Ajax.php#L294 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Ajax.php#L294 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Lesson.php#L243 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Lesson.php#L243 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1997 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Course.php#L1997 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Ajax.php#L507 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Ajax.php#L507 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L888 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Quiz.php#L888 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Q_And_A.php#L339 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Q_And_A.php#L339 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Lesson.php#L186 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Lesson.php#L186 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L1007 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Quiz.php#L1007 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Utils.php#L7829 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Utils.php#L8020 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Lesson.php#L341 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Quiz.php#L1041 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L2045 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php#L586 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Announcements.php#L105 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Q_And_A.php#L219 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Q_And_A.php#L297 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php#L294 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Lesson.php#L243 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1997 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Ajax.php#L507 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Quiz.php#L888 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Q_And_A.php#L339 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Lesson.php#L186 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Quiz.php#L1007 (opens in a new tab)
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3518400%40tutor&new=3518400%40tutor&sfp_email=&sfph_mail= (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-29914 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-6965)Record last updated .