CVE-2026-18439 in Tutor LMS Plugin
Summary
by MITRE • 09/22/2026
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The Tutor LMS plugin for WordPress contains a critical Insecure Direct Object Reference vulnerability in versions up to 4.0.7 that allows authenticated attackers with Instructor-level access or higher to manipulate course content belonging to other users. This flaw resides within the tutor_quiz_builder_save AJAX action handler, which processes requests used by instructors and administrators to manage quiz structures. The core technical deficiency is a lack of authorization checks for nested identifiers contained within the request payload. While the application correctly validates top-level parameters such as course_id, topic_id, and an optional ID field against the requester's permissions, it fails to verify that the nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] arrays correspond to resources owned by or accessible to the authenticated user.
From a technical perspective, these unvalidated identifiers are passed directly into database update and delete operations via $wpdb->update and DELETE statements within the QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete() methods. Because there is no secondary verification step ensuring that each specific question or answer ID belongs to a quiz associated with the requesting user's authorized courses, an attacker can supply identifiers belonging to other instructors or administrators. This architectural oversight effectively bypasses the intended access control boundaries of the application layer, allowing direct manipulation of database records outside the scope of the requester's privileges.
The operational impact of this vulnerability is significant for multi-instructor learning management systems where content ownership and integrity are paramount. An attacker can overwrite existing quiz questions and answers with malicious or incorrect content, thereby compromising the educational value and reputation of other instructors' courses. Furthermore, the ability to delete arbitrary question and answer rows means that an attacker can permanently destroy course materials created by others. This not only disrupts the learning experience for students enrolled in those courses but also represents a denial of service against the intellectual property and operational continuity of fellow content creators on the platform.
This vulnerability aligns with CWE-284, which describes Improper Access Control where insufficient authorization checks allow users to access or modify data belonging to other entities. It is further categorized under OWASP Top 10 as Broken Object Level Authorization (BOLA), reflecting the failure to enforce proper object-level permissions on API endpoints that handle resource manipulation. In terms of adversary tactics, this exploitation technique maps to MITRE ATT&CK Tactic TA0043: Impact and specifically techniques related to Data Manipulation or Defacement, such as modifying data within a system to disrupt operations or alter information integrity for malicious purposes.
Mitigation strategies should prioritize immediate patching to the latest version of Tutor LMS where these authorization checks have been corrected. For organizations unable to update immediately due to compatibility constraints, implementing a Web Application Firewall rule that inspects AJAX payloads for suspicious patterns in nested ID arrays may provide partial protection, though this is not a substitute for code-level fixes. Developers must ensure that all user-supplied identifiers used in database queries are validated against the current session's authorized resource list before execution. This includes verifying ownership or explicit sharing permissions for every individual item within batched operations like question and answer updates or deletions to prevent unauthorized cross-user data manipulation.