The vulnerability allows an authenticated user with Instructor or higher privileges to send a specially crafted payload to the tutor_quiz_builder_save AJAX action in the Tutor LMS plugin. Because the code only validates the top‑level course, topic, and payload ID values, the nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] are accepted without verifying ownership. This results in direct database UPDATE and DELETE statements that can overwrite or remove any quiz question or answer belonging to other instructors or administrators, thereby compromising data integrity and availability. The weakness corresponds to an authorization bypass where user-controlled identifiers are used without proper permission checks.

This issue affects the Tutor LMS – eLearning and online course solution plugin for WordPress, versions up to and including 4.0.7 (including earlier releases such as 3.9.10 and 4.0.3). Users running any of these aware versions are potentially impacted.

The CWE‑639 category indicates an authorization bypass through user‑controlled keys. The CVSS score of 4.3 reflects a moderate impact consistent with a data‑integrity risk that requires authentication but does not directly compromise confidentiality or overall system compromise. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower exploitation probability, though a carefully crafted attacker with instructor privileges can locally manipulate quiz data. The primary attack vector is via an authenticated web interface. The overall risk is moderate; organizations should update or mitigate promptly.