PT-2026-57739 · Themeum+1 · Tutor Lms+1
CVE-2026-57694
·
Published
2026-07-06
·
Updated
2026-07-13
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Tutor LMS versions prior to 3.9.14
Description
The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) issue, which occurs when an application provides direct access to objects based on user-supplied input. This is caused by missing validation on a user-controlled key, allowing authenticated attackers with Subscriber-level access and above to bypass access control security levels and perform unauthorized actions.
Recommendations
Update the plugin to a version newer than 3.9.13.
Fix
DoS
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tutor Lms
Tutor