Security readout for executives and security teams
Plain-English summary
Tutor LMS for WordPress has an authorization flaw allowing a logged-in Instructor or higher user to alter or delete courses they do not own. For businesses using Tutor LMS to deliver paid or operational training, this threatens course integrity and availability, not data confidentiality based on the published CVSS vector.
Executive priority
Treat as high priority for any production learning site with multiple instructors or paid course content. The main business risk is unauthorized course tampering or deletion, which can disrupt revenue, training delivery, and customer trust.
Technical view
CVE-2026-1375 is a CWE-639 IDOR in Tutor LMS through 3.9.5. Missing object-level authorization checks affect course_list_bulk_action(), bulk_delete_course(), and update_course_status(). An authenticated Instructor+ user can manipulate course identifiers in bulk action requests to modify status or delete arbitrary courses. CVSS 3.1 is 8.1, with high integrity and availability impact.
Likely exposure
Exposure is limited to WordPress sites running Tutor LMS versions up to and including 3.9.5, especially sites with multiple or less-trusted Instructor accounts. The attacker needs a valid Instructor-level or higher account; anonymous users are not described as affected.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The vulnerability is network-accessible, low-complexity, and requires authenticated low-privilege access within Tutor LMS. Abuse could disrupt courses or tamper with course state without needing course ownership.
Researcher notes
The public record identifies affected functions and links to WordPress plugin source and a changeset. Fixed-version details are not explicit in the provided bundle, so confirm current vendor release notes before declaring remediation complete. Avoid assuming public exploitation without additional evidence.
Mitigation direction
- Check Themeum or WordPress plugin guidance and apply the update containing Course_List authorization fixes.
- Restrict Tutor Instructor and higher roles to trusted accounts until remediation is complete.
- Review and remove unnecessary Instructor-level accounts on affected sites.
- Back up course content before remediation and preserve recent course-change records.
- Monitor for unexpected course status changes, bulk actions, or deletions.
Validation and detection
- Inventory WordPress sites using Tutor LMS and record installed plugin versions.
- Flag Tutor LMS installations running 3.9.5 or earlier.
- Review Instructor and higher user accounts for unnecessary access.
- Confirm updated code adds object-level permission checks to affected course actions.
- Audit recent course deletions and status changes for unauthorized activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1375 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4e95b32b-c050-41eb-8fce-461257420eb6?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/classes/Course_List.php#L289CVE reference
- https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/classes/Course_List.php?contextall=1&old=3339576&old_path=%2Ftutor%2Ftrunk%2Fclasses%2FCourse_List.phpCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.