{"affected":[{"defaultStatus":"unaffected","product":"Tutor LMS – eLearning and online course solution","source":"CNA: Wordfence","vendor":"themeum","versions":[{"lessThanOrEqual":"4.1.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-93779","cwes":["CWE-639"],"description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation requires that the attacker hold a valid Tutor LMS API key/secret pair, which is issued to subscriber-level users through the plugin's API key management feature.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794028743047,"publishedAt":1794025633948,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L460"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L376"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L418"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Course.php#L303"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Quiz.php#L209"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Author.php#L43"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/RestAuth.php#L331"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L135"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3748228%40tutor&new=3748228%40tutor"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L135"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L376"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L418"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/RestAPI.php#L460"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Author.php#L43"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Course.php#L303"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/REST_Quiz.php#L209"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/restapi/RestAuth.php#L331"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3748228%40tutor&new=3748228%40tutor"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=cve"}],"remediation":[],"revision":"9b1ff71d4cea804c40f7d7a568bf081e048f64563be746d3ffd6985d888473a8","sources":[{"modifiedAt":1794025633948,"name":"CNA: Wordfence","retrievedAt":1794028414853,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93779"},{"modifiedAt":1794028743047,"name":"NVD","retrievedAt":1794032228710,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93779"}],"ssvc":null,"status":"published","title":"Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints","updatedAt":1794032228710}