{"id":"CVE-2026-93779","aliases":[],"cve":{"records":[{"id":"CVE-2026-93779","source":"Wordfence","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T17:52:10.222Z","published":"2026-11-07T04:27:13.948Z","modified":"2026-11-08T19:05:24.622Z"}],"publishers":[{"name":"Wordfence","role":"CNA","organizationId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","modified":"2026-11-07T04:27:13.948Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-08T19:05:24.622Z"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=cve","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L460","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L376","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L418","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Course.php#L303","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Quiz.php#L209","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Author.php#L43","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/RestAuth.php#L331","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L135","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3748228%40tutor&new=3748228%40tutor","tags":[],"source":"Wordfence"}],"weaknesses":[{"id":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","source":"Wordfence"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-08T18:49:55.308784Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints","titleSource":"Wordfence","descriptionSource":"Wordfence","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.","score":6.5,"severity":"medium","published":"2026-11-07T04:27:13.948Z","modified":"2026-11-08T19:05:24.622Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"themeum","name":"Tutor LMS – eLearning and online course solution","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.1.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-93779"}],"remediation":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=cve","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L460","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L376","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L418","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Course.php#L303","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Quiz.php#L209","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Author.php#L43","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/RestAuth.php#L331","https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L135","https://plugins.trac.wordpress.org/changeset?reponame=&old=3748228%40tutor&new=3748228%40tutor"],"sources":[{"name":"CVE","id":"CVE-2026-93779","modified":"2026-11-08T19:05:24.622Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93779"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-08T19:23:27.753Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-07T04:40:34.269Z","attemptedAt":"2026-11-07T04:40:34.269Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-07T04:40:33.795Z","attemptedAt":"2026-11-07T04:40:33.795Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-07T04:40:33.634Z","attemptedAt":"2026-11-07T04:40:33.634Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-07T04:40:33.755Z","attemptedAt":"2026-11-07T04:40:33.755Z"}],"evidence":[],"aiSummary":{"text":"Tutor LMS versions up to 4.1.2 have an insecure direct object reference vulnerability, allowing authenticated attackers with subscriber-level access to read sensitive information via REST API endpoints. Attackers must hold a valid API key/secret pair. This exposes paid course content and user data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-07T04:36:06.514Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93779"}]}}