The vulnerability allows an authenticated author or higher‑privileged user to modify any course created by other instructors. By supplying an arbitrary course ID in the POST payload, the plugin’s sanitization routine preserves the attacker’s key, and WordPress treats the non‑empty ID as an update operation. This leads to overwriting the course title, content, and status, and to reassigning ownership of the course to the attacker. The weakness is an instance of Insecure Direct Object Reference (CWE‑639).

All installations of the Tutor LMS eLearning plugin for WordPress with versions up to and including 4.1.0 are susceptible. The flaw resides in the Course class where the ID parameter is not validated against the authenticated user’s ownership before processing updates.

The CVSS v3 score of 4.3 denotes a moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the author level or higher, and the attack vector is through the WordPress admin interface where the POST ID parameter can be injected. The impact is confined to course data and ownership but can be used to disrupt instructors’ content, deface the site, or facilitate further attacks by gaining control of legitimate course pages.