We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Tutor LMS – eLearning and online course solution Plugin Vulnerability (CVE-2026-18439)

Nick Paliughi
On this page

Security Alert Summary

The Tutor LMS – eLearning and online course solution WordPress plugin is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the tutor_quiz_builder_save AJAX action. Missing validation of nested identifiers in the submitted payload allows authenticated users with Instructor-level access and above to modify or delete quiz questions and answers that belong to other instructors or administrators.

CVE Details

  • CVE ID: CVE-2026-18439
  • Affected product: Tutor LMS – eLearning and online course solution (plugin)
  • Affected versions: versions up to and including 4.0.7
  • Published: September 22, 2026 at 8:16:39 AM
  • Last modified: September 22, 2026 at 8:16:39 AM
  • CVSS v3.1 base score: 4.3
  • CVSS v3.1 severity: MEDIUM
  • CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • Authentication / privileges / user interaction:
    • Authentication: authenticated users (Instructor-level and above as stated in the description)
    • Privileges required: Low (PR:L)
    • User interaction: None (UI:N)
  • Primary impact:
    • Confidentiality: None
    • Integrity: Low (ability to overwrite or re-parent quiz questions/answers)
    • Availability: None
  • Weakness (CWE): CWE-639

Technical Details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the tutor_quiz_builder_save AJAX action. The request handler validates top-level identifiers such as course_id, topic_id, and, when supplied, payload['ID'], but it fails to validate nested identifiers in the submitted payload. Specifically, nested values like question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] are not checked to ensure they belong to a quiz, topic, or course the requester is authorized to manage.

Those nested identifiers are passed directly into database modification calls (notably $wpdb->update and $wpdb->delete) inside QuizBuilder methods named QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). Because the nested IDs are trusted without owner/permission checks, an authenticated user with Instructor-level privileges can overwrite content, change parent relationships for quiz questions/answers, or delete arbitrary quiz question and answer rows belonging to other instructors or administrators.

The impact is limited to integrity of quiz-related data; the CVSS vector indicates no direct confidentiality or availability impact. The issue exists due to missing server-side ownership/authorization checks on nested object identifiers in the request payload.

How This Could Impact Your Website

Consider a site where the site owner manages course structure, internal staff maintain content, and external instructors or contractors contribute quizzes. An attacker who has Instructor-level access on the site could alter or delete questions and answers created by other instructors. Possible practical consequences include lost quiz content, confusion for learners, or altered assessments that affect course integrity. While the CVSS data shows no confidentiality impact, attackers changing quiz content could still create opportunities for social engineering or targeted phishing by leveraging knowledge of course structure or timing. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor and instructor roles where possible.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and audit logs for unusual behavior related to quiz creation or deletion.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
WP Yelp Review Slider Plugin Vulnerability (CVE-2026-93778)
Next Post
MarketKing Plugin Vulnerability (CVE-2026-93344)