Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1375 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including… https://www.cve.org/CVERecord?id=CVE-2026-1375
Post summary
CVE‑2026‑1375 is disclosed as an IDOR flaw in all Tutor LMS versions up to a certain point; no PoC, exploit, patch, or active exploitation details are provided.
CVE-2026-1375 Tutor LMS WordPress Plugin IDOR Vulnerability Allows Unauthorized Course Modification https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1375
Post summary
A newly disclosed IDOR vulnerability in the Tutor LMS WordPress plugin enables unauthorized course modifications, but no PoC, exploit, or patch information is provided.
🟠 CVE-2026-1375 - High The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due t... https://www.thehackerwire.com/vulnerability/CVE-2026-1375/ https://t.co/ksAjFmKKYP
Post summary
The tweet discloses that the Tutor LMS WordPress plugin has an IDOR vulnerability in versions up to 3.9.5, without providing PoC, exploit code, or patch information.