The Tutor LMS plugin for WordPress allows authenticated users with subscriber-level access or higher to manipulate course content via the tutor_update_course_content_order() function. The function validates only the CSRF nonce and bypasses any authorization check when the 'content_parent' parameter is omitted, directly calling save_course_content_order() which writes to the wp_posts table. This missing authorization (CWE-862) lets attackers detach lessons from topics, move lessons between topics, and alter the menu order of course content, effectively disrupting the structure of any course on the site.

This vulnerability affects the Tutor LMS – eLearning and online course solution plugin for WordPress versions up to and including 3.9.8. No specific sub‑version details are listed beyond the major release boundary; users of 3.9.8 or earlier are impacted while 3.9.9 and later contain the remediation.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the WordPress site with at least subscriber privileges, then send a crafted request that omits the 'content_parent' field. Because the check is bypassed, the attacker can perform arbitrary reordering of lessons and content, which may deny legitimate users access to course materials or severely degrade the learning experience.