The Tutor LMS eLearning plugin for WordPress contains an Insecure Direct Object Reference flaw caused by missing authorization checks in the bulk action handlers. Authenticated users with Instructor or higher level access can manipulate the course ID fields in bulk action requests to modify or delete any course, regardless of ownership. This can lead to unauthorized alteration of course content, deletion of courses, and loss of educational material and revenue for the site owner.

All installations of Tutor LMS up to and including version 3.9.5 are vulnerable. Any WordPress site that has installed one of these revisions and has users with the Instructor role or better is at risk, regardless of the number of courses or users.

The vulnerability has a CVSS score of 8.1, indicating high severity, but the EPSS score is less than 1%, suggesting that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session, so the attack vector is inferred to be an authenticated API or administrative interface that the plugin exposes for bulk course management.