The vulnerability arises from an IDOR flaw in the post reparenting endpoint of the Tutor LMS WordPress plugin. Neither the plugin nor WordPress checks whether the post that is being reassigned actually belongs to a course managed by the instructor making the request. As a result, instructors can change the parent of any post on the site, moving content from other instructors’ courses into their own and making other published content inaccessible. This leads to loss of integrity and availability of course material.

Affected systems are WordPress installations that use the Tutor LMS plugin with a version earlier than 4.1.1, specifically 4.0.5 through 4.1.0. The issue applies only to users who have the Instructor role or higher. Site administrators should verify which version of the plugin is active; any older version is vulnerable.

The CVSS score is 6.5, and the EPSS score is unavailable, but the vulnerability can be exploited by any authenticated instructor via the content ordering interface, which is a local attacker scenario. Because it allows privilege escalation within the application and loss of content visibility, the risk is considered high. There is currently no listing in the CISA KEV catalog, indicating that no widespread exploitation has been reported yet.