Tutor LMS course authorization mismatch exposes and modifies private Q&A threads
Tutor LMS before 4.0.0 exposes the tutor_qna_create_update AJAX action to an authenticated user who can obtain a front-end _tutor_nonce and access any one course. The handler authorizes the supplied course_id but performs the read and reply operation against the separately supplied question_id without confirming that the question belongs to that course. A Subscriber can therefore pair an accessible course_id with a question_id from another course, receive that course's Q&A content and create a reply under the private thread.
- Component
- Tutor LMS
- Plugin slug
tutor-lms- Affected
- < 4.0.0
- Safe version
4.0.0- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 37 known issues for this plugin.
Update, patch or deactivate.
Update Tutor LMS to 4.0.0 or later. Review private-course Q&A threads for replies from users who were not enrolled in or otherwise authorized for the course.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N