The Tutor LMS plugin contains an Insecure Direct Object Reference flaw that allows authenticated users with subscriber or higher privileges to alter course structure. The vulnerability arises from a missing authorization check in the save_course_content_order() method, which processes attacker-supplied data without verifying ownership. This can lead to lessons being detached from topics, reordered, or reassigned across courses, compromising the integrity of course materials. The weakness corresponds to CWE‑639, where improper checks on user permissions grant unauthorized access to sensitive operations.

All installations of the Tutor LMS – eLearning and online course solution plugin for WordPress with version 3.9.7 or earlier are affected. The vulnerability impacts any WordPress site that uses this plugin to deliver courses to students.

The CVSS score of 4.3 indicates a medium severity. Explorability is limited by the requirement of user authentication, but the attacker simply needs to craft an AJAX request with manipulated lesson and topic IDs, a capability available to any subscriber or higher role. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack is feasible in typical environments where the plugin is enabled, and it can be exploited by internal users familiar with WordPress AJAX endpoints.