CVE-2026-92715Published
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-92715 · Microsoft / collected KEV context
cve-program · CVE-2026-92715
- https://www.wordfence.com/threat-intel/vulnerabilities/id/12f093bd-5230-4103-b571-80543c1b43cf?source=cve
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L1053
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L1009
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L850
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L303
- https://plugins.trac.wordpress.org/changeset/3730615/tutor/trunk/classes/Course.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.