CVE-2026-85571

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1

Description The plugin fails to verify if the posts specified in course content ordering requests belong to a course managed by the requester. This allows users with instructor-level access to perform an Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to reassign the parent of any post on the site. Consequently, an attacker can move course content from other instructors into their own courses or make arbitrary published content unreachable.

Recommendations Update to version 4.1.1 or later.