Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.41% · 35th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Tutor LMS, a WordPress plugin for online courses, has an insecure direct object reference flaw in its REST API endpoints. A remote attacker with a low-privilege subscriber-level account and a valid API key and secret pair can read paid lesson content without enrolling, retrieve quiz answer keys, and collect other users' email addresses and usernames.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure3/25Reachable over the network · Unknown: No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity6.5/10CVSS 6.5
- No patch5/5No patch listed yet
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
- Would score about 34 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
Affected versions
- themeum Tutor LMS – eLearning and online course solution
through 4.1.2
Evidence 10
- Link
- Link
- Link
- Link
- Link
Show all 10 sourcesShow fewer sources
- Link
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-93779
Is CVE-2026-93779 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-93779?
Tutor LMS – eLearning and online course solution: through 4.1.2.Source: cve.now feed data