Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92715— Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter

Quick assessment

Affected
themeum Tutor LMS – eLearning and online course solution
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Tutor LMS（一款用于电子学习和在线课程管理的解决方案）在所有 4.1.0 及更早版本中存在不安全的直接对象引用（IDOR）漏洞。该漏洞源于对由用户控制的"ID"参数缺乏验证。这使得拥有作者（Author）级别或更高权限的已认证攻击者能够修改由其他讲师创建的任意课程，包括覆盖课程的标题、内容和状态，并将课程的所有权重新分配给自己。 该漏洞之所以可行，是因为 函数保留了攻击者通过 POST 请求提供的键名（包括"ID"），而未将其移除；而 WordPress 在调用 时，会将参数数组中

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92715

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
themeum Tutor LMS – eLearning and online course solution 0 ~ 4.1.0 -

II. Public POCs for CVE-2026-92715

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92715

请登录查看更多情报信息。

Other References for CVE-2026-92715 (6)

Same Patch Batch · themeum · 2026-10-17 · 3 CVEs total

CVE-2026-107762 7.5 HIGH Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information
CVE-2026-104734 7.2 HIGH Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization o

IV. Related Vulnerabilities

Same product: Tutor LMS – eLearning and online course solution
Same vendor: themeum
Same weakness: CWE-639

V. Comments for CVE-2026-92715

No comments yet

Leave a comment