CVE-2026-18439 Missing authorization in Tutor LMS – eLearning and online course solution
Authenticated instructors can modify or delete arbitrary quiz questions and answers belonging to other users due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18439?
CVE-2026-18439 is a medium-severity missing authorization vulnerability in themeum Tutor LMS – eLearning and online course solution, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
Weakness: CWE-639
Which versions are affected by CVE-2026-18439?
How do I fix CVE-2026-18439?
No fix has been published for CVE-2026-18439 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18439 being exploited?
There is no known exploitation of CVE-2026-18439 in the wild and no public exploit code.
Sources
Also known as GHSA-9x9f-f428-ff8p.