{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5502", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-03T15:48:58.659Z", "datePublished": "2026-04-17T03:36:45.463Z", "dateUpdated": "2026-04-17T14:28:01.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-17T03:36:45.463Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site."}], "title": "Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1700"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1789"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1789"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1700"}, {"url": "https://plugins.trac.wordpress.org/changeset/3505142/tutor/tags/3.9.9/classes/Course.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "momopon1415"}], "timeline": [{"time": "2026-04-03T16:04:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-16T15:10:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T14:27:27.845133Z", "id": "CVE-2026-5502", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T14:28:01.492Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T14:27:27.845133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T14:27:50.293Z"}}], "cna": {"title": "Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order", "credits": [{"lang": "en", "type": "finder", "value": "momopon1415"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.9.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-03T16:04:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-16T15:10:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1700"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1789"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1789"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1700"}, {"url": "https://plugins.trac.wordpress.org/changeset/3505142/tutor/tags/3.9.9/classes/Course.php"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-17T03:36:45.463Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5502", "state": "PUBLISHED", "dateUpdated": "2026-04-17T14:28:01.492Z", "dateReserved": "2026-04-03T15:48:58.659Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-17T03:36:45.463Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site."}], "id": "CVE-2026-5502", "lastModified": "2026-04-22T20:22:50.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-17T05:16:19.117", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1700"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L1789"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1700"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1789"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3505142/tutor/tags/3.9.9/classes/Course.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.9.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Tutor LMS \u2013 eLearning and online course solution", "source": "cna", "vendor": "themeum"}, "product": "tutor_lms_\u2013_elearning_and_online_course_solution", "vendor": "themeum"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-17T05:50:48.609613+00:00", "value": {"mitigation_remediation": ["Upgrade the Tutor LMS plugin to version 3.9.9 or later to restore the proper authorization check on tutor_update_course_content_order().", "If an immediate upgrade is not feasible, modify the WordPress user role settings to remove the capability that allows subscribers and similar roles to edit course content, thereby preventing unauthorized manipulation from those users.", "Alternatively, apply a temporary code patch to the Tutor LMS plugin by adding a can_user_manage() check that executes regardless of whether the 'content_parent' parameter is present, ensuring that only users with the appropriate permissions can modify course content."], "summary": {"action": "Apply Patch", "impact": "Course Content Manipulation"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the Tutor LMS \u2013 eLearning and online course solution plugin for WordPress versions up to and including 3.9.8. No specific sub\u2011version details are listed beyond the major release boundary; users of 3.9.8 or earlier are impacted while 3.9.9 and later contain the remediation.", "description_and_impact": "The Tutor LMS plugin for WordPress allows authenticated users with subscriber-level access or higher to manipulate course content via the tutor_update_course_content_order() function. The function validates only the CSRF nonce and bypasses any authorization check when the 'content_parent' parameter is omitted, directly calling save_course_content_order() which writes to the wp_posts table. This missing authorization (CWE-862) lets attackers detach lessons from topics, move lessons between topics, and alter the menu order of course content, effectively disrupting the structure of any course on the site.", "risk_and_exploitability": "The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the WordPress site with at least subscriber privileges, then send a crafted request that omits the 'content_parent' field. Because the check is bypassed, the attacker can perform arbitrary reordering of lessons and content, which may deny legitimate users access to course materials or severely degrade the learning experience."}}}}, "created": "2026-04-17T06:00:09.078026+00:00", "updated": "2026-04-17T06:00:09.259970+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms_\u2013_elearning_and_online_course_solution", "wordpress", "wordpress$PRODUCT$wordpress"]}