CVE-2026-89333

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.9

Description The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs because of missing validation on a user-controlled key, allowing authenticated attackers with subscriber-level access or higher to disclose sensitive information. By iterating over user IDs via the student id parameter, an attacker can obtain the email addresses and Tutor profile phone numbers of arbitrary WordPress users, including those with Administrator privileges.

Recommendations Update the plugin to a version newer than 4.0.8. As a temporary mitigation, restrict access to the student id parameter for users with subscriber-level permissions.