CVE-2026-88944 in Tutor LMS Plugin
Summary
by MITRE • 09/19/2026
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in the Tutor LMS plugin for WordPress represents a critical authorization bypass flaw affecting all versions up to and including 4.0.8. This security defect stems from insufficient verification of user privileges when executing administrative actions, specifically allowing authenticated users with subscriber-level access or higher to perform operations that should be restricted to administrators or editors. The core technical failure lies in the plugin's handling of post deletion requests, where it fails to adequately validate whether the requesting user possesses the necessary permissions to delete arbitrary content within the WordPress ecosystem. This oversight enables attackers to permanently remove posts including pages, courses, quizzes, and WooCommerce products by exploiting the wp_delete_post function with a forceful deletion parameter that bypasses standard trash mechanisms.
The exploitation of this vulnerability requires a specific multi-step attack chain rather than a simple direct invocation of the delete endpoint. An attacker must first leverage the profile-photo upload functionality to create an attachment entry within the WordPress database, thereby establishing a legitimate authored wp_posts row under their control. This initial step is crucial as it provides the necessary context and structural element required for subsequent actions. Following this, the attacker creates a Tutor topic that is reparented to the previously created attachment. This manipulation of data relationships allows the attacker to position themselves within the plugin's internal logic in a way that circumvents standard permission checks during the final deletion phase.
Once the prerequisite conditions are met through the profile upload and topic creation steps, the attacker can invoke the lesson deletion handler with any target post ID as an argument. Because the authorization check is flawed, the system processes this request without verifying if the user has legitimate rights to delete that specific content type or instance. This results in the permanent destruction of arbitrary posts across various content types supported by WordPress and Tutor LMS. The impact extends beyond simple data loss; it compromises the integrity of online courses, disrupts educational workflows, and can lead to significant operational downtime for institutions relying on this platform for eLearning delivery.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Control, as the system fails to enforce appropriate access levels for sensitive operations. It also relates to CWE-732, involving Incorrect Permission Assignment for Critical Resource, since the deletion capability is granted to users who should not possess it based on their role hierarchy. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques associated with Defense Evasion and Impact categories, specifically those involving data destruction or manipulation through unauthorized API calls. The attack vector leverages authenticated access, placing it within the scope of internal threat scenarios where compromised low-privilege accounts are used to escalate impact.
Mitigation strategies must prioritize immediate updates to version 4.0.9 or later, which address these authorization checks by implementing stricter validation logic before executing deletion commands. Administrators should also enforce role-based access controls rigorously and monitor for unusual patterns of post creation followed immediately by deletions, particularly involving attachment uploads from subscriber accounts. Implementing Web Application Firewalls with rules targeting suspicious wp_delete_post calls originating from non-administrative IPs can provide an additional layer of defense during the transition period. Regular audits of user permissions and disabling unnecessary file upload features for lower-tier users further reduces the attack surface available to potential exploiters seeking to manipulate post relationships for malicious purposes.