The Tutor LMS plugin for WordPress permits authenticated attackers with instructor-level privileges to delete any instructor’s course content, including lessons, quizzes, assignments, announcements, and Q&A threads. The vulnerability arises from the get_course_id_by() function unconditionally trusting a user‑supplied course GET parameter, which then bypasses the plugin’s authorization gate for management actions. As a result, an attacker can permanently remove student attempt data, manipulate grades, and read unpublished content. These activities compromise data integrity and confidentiality for all affected courses.

WordPress installations running the Tutor LMS plugin version 3.9.9 or earlier. Any site that has the plugin installed and has users with instructor-level or higher privileges is at risk. No other vendors or product versions are currently noted as affected.

The CVSS score of 5.3 indicates a medium‑severity risk, and there is no EPSS data available. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site with at least instructor credentials; the exploitation path then involves sending a crafted request containing a malicious course ID in the GET parameter. Once the request reaches the can_user_manage() gate, the owner check is performed against the attacker‑supplied ID, allowing arbitrary deletion or modification of another instructor’s content.