Owlmind

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp insert post() argument array as an update to the existing post rather than a new insert.

**Name of the Vulnerable Software and Affected Versions** LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 **Description** An Insecure Direct Object Reference exists because the `process step customer()` function relies solely on `is user logged in()` to validate requests before merging POSTed customer data into an existing record, lacking necessary ownership checks. Authenticated users with Subscriber-level access or higher can modify the personal information of arbitrary customers, including first name, last name, email, phone, and notes. Additionally, if the `contact merge` setting is configured as 'phone', an attacker can overwrite a victim's email address to facilitate account takeover through a password reset. **Recommendations** Update the plugin to a version later than 5.6.9.