CVE-2026-92715 themeum CVE debrief

Who should care

WordPress site administrators and owners using the Tutor LMS plugin should assess exposure and prioritize remediation. This vulnerability requires attention from security teams responsible for maintaining WordPress installations with the Tutor LMS plugin.

Why it matters

CVE-2026-92715 is a medium-severity vulnerability in the Tutor LMS plugin for WordPress, allowing authenticated attackers with author-level access to modify arbitrary courses and reassign ownership. Defenders should prioritize remediation and verify course changes to prevent unauthorized modifications.

• Authenticated attackers with author-level access can modify arbitrary courses and reassign ownership, potentially leading to unauthorized changes and disruptions.
• Course content and ownership changes can occur without proper authorization, affecting the integrity of educational materials and user trust.
• Verification of course modifications and ownership updates is necessary to detect potential exploitation.
• Remediation priority is medium due to the potential for unauthorized changes and the availability of patches.

Technical summary

The Tutor LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0. The vulnerability allows authenticated attackers with author-level access and above to modify arbitrary courses created by other instructors and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert. The issue arises from

Defensive priority

Medium

Recommended defensive actions

• Review and update Tutor LMS plugin to a version that addresses the Insecure Direct Object Reference vulnerability
• Restrict course modification and ownership reassignment to authorized users
• Monitor course changes and ownership updates for suspicious activity
• Implement additional validation and sanitization for user-controlled input
• Verify course modifications and ownership updates to detect potential exploitation
• Conduct regular security audits to identify and address potential vulnerabilities
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Tutor LMS plugin vulnerability. The vulnerability allows authenticated attackers with author-level access to modify arbitrary courses and reassign ownership. The issue is due to missing validation on a user-controlled key in the 'ID' parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.