High severity8.1NVD Advisory· Published Feb 3, 2026· Updated Apr 15, 2026
CVE-2026-1375
CVE-2026-1375
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the course_list_bulk_action(), bulk_delete_course(), and update_course_status() functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=3.9.5
Patches
Vulnerability mechanics
References
5- plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.phpnvd
- plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/classes/Course_List.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/4e95b32b-c050-41eb-8fce-461257420eb6nvd
News mentions
0No linked articles in our index yet.