Themeum

By the Year

In 2026 there have been 70 vulnerabilities in Themeum with an average score of 6.2 out of ten. Last year, in 2025 Themeum had 14 security vulnerabilities published. That is, 56 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.52.

Recent Themeum Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-92715	Oct 17, 2026	Tutor LMS <=4.1.0 ID-based IDOR via wp_insert_post() The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors overwriting their title, content, and status and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.	Tutor Lms
CVE-2026-93681	Oct 16, 2026	Stored XSS via display_name in Tutor LMS <=4.1.0 The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.	Tutor Lms
CVE-2026-88963	Oct 16, 2026	Tutor LMS 4.0.8 DOM XSS via redirect_url in Topbar The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.	Tutor Lms
CVE-2026-14572	Oct 15, 2026	Kirki Freeform WP Plugin <=6.2.0 XSS via Text Content The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Kirki
CVE-2026-42702	Oct 10, 2026	Unauthenticated XSS in Tutor LMS <= 4.1.0 (WordPress) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.	Tutor Lms
CVE-2026-42698	Oct 08, 2026	Tutor LMS 4.1.1 Race Condition in Shared Resource Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.	Tutor Lms
CVE-2026-18335	Sep 24, 2026	Kirki 6.2.0 Blind SSRF via kirki_data Parameter The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.	Kirki
CVE-2026-18439	Sep 22, 2026	Tutor LMS <=4.0.7 IDOR on quiz_builder_save AJAX: overwrite questions The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.	Tutor Lms
CVE-2026-89081	Sep 19, 2026	Tutor LMS <4.0.8 Reflected XSS via search param The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Tutor Lms
CVE-2026-88944	Sep 19, 2026	TutorLMS WP Plugin Auth Bypass v4.0.8 enables post deletion The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts including pages, courses, quizzes, and WooCommerce products via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.	Tutor Lms
CVE-2026-89333	Sep 19, 2026	IDOR in Tutor LMS <=4.0.8 via student_id The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.	Tutor Lms
CVE-2026-92465	Sep 16, 2026	Themeum WP Mega Menu <=1.4.2 SQL Injection via Special Elements Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.	Wp Megamenu
CVE-2026-78175	Sep 12, 2026	Tutor LMS <4.0.7 PHP Object Injection via AJAX withdraw_method_field The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.	Tutor Lms
CVE-2026-17037	Sep 11, 2026	CVE-2026-17037: Stored XSS in Kirki Freeform v<=6.2.0 Comment Input The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Kirki
CVE-2026-19945	Sep 09, 2026	WP Crowdfunding <=2.2.1 Stored XSS via first_name param The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.	Wp Crowdfunding
CVE-2026-19944	Sep 09, 2026	WP Crowdfunding <=2.2.1 SQLi via wpneo_reward Post Meta The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar.	Wp Crowdfunding
CVE-2026-16759	Aug 28, 2026	Tutor LMS <=4.0.5 RCE via tutor_course_filter_ajax - zero-arg func call The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.	Tutor Lms
CVE-2026-73189	Aug 18, 2026	WP Crowdfunding <2.2.1: Subscriber IDOR Vulnerability	Wp Crowdfunding
CVE-2026-66629	Aug 18, 2026	Unauthenticated XSS in Kirki <=6.2.3 WP Plugin Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.	Kirki
CVE-2026-18347	Aug 16, 2026	Kirki Freeform Page Builder 6.1.1 Auth Bypass The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields including email address, assigned roles, registration date, and any user_meta values belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.	Kirki
CVE-2026-17604	Aug 16, 2026	Kirki 6.1.1: DirTrav via data Param (Editor+) The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.	Kirki
CVE-2026-16974	Aug 11, 2026	Stored XSS in Kirki Freeform Page Builder <=6.2.0 via Shortcode The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Kirki
CVE-2026-15601	Aug 01, 2026	Kirki Freeform Page Builder Path Traversal (Zip Slip) in v6.0.13 The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.	Kirki
CVE-2026-15444	Jul 28, 2026	WP Tutor LMS SQLi via coupon_code <=4.0.1 The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Tutor Lms
CVE-2026-65436	Jul 27, 2026	Kirki<=6.0.13 Arbitrary File Deletion via Editor Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.	Kirki
CVE-2026-13464	Jul 24, 2026	Kirki WP Plugin v6.0.14 IDOR via 'context' Param The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post including drafts, pending, privately published, password-protected, and trashed posts regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.	Kirki
CVE-2026-65531	Jul 23, 2026	Unauth BBAC in Qubely <=1.8.14 (WordPress) Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.	Qubely
CVE-2026-1372	Jul 21, 2026	Tutor LMS Elementor Addons - Missing Auth up to 4.0.0 The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.	Tutor Lms Elementor Addons
CVE-2026-15457	Jul 17, 2026	Kirki Freeform Dir Traversal <6.0.13 The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.	Kirki
CVE-2026-15022	Jul 16, 2026	Tutor LMS 4.0.0 SQLi via Stored Quiz Answer Array, WordPress plugin The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.	Tutor Lms
CVE-2026-57727	Jul 13, 2026	Missing AuthN in Themeum Kirki <=6.0.13 Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.	Kirki
CVE-2026-57726	Jul 13, 2026	Kirki <=6.0.12 Blind SQL Injection via Special Elements Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.	Kirki
CVE-2026-57725	Jul 13, 2026	WordPress Kirki <=6.0.11 Stored XSS in kirki Component Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.	Kirki
CVE-2026-57724	Jul 13, 2026	Deserialization Vulnerability in Themeum Kirki <=6.0.12 (Object Injection) Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.	Kirki
CVE-2026-57694	Jul 13, 2026	Tutor LMS <=3.9.13 Auth Bypass via User-Controlled Key Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.	Tutor Lms
CVE-2026-57680	Jul 02, 2026	Kirki <=6.0.11 IDOR Unauthenticated Access Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.
CVE-2026-12472	Jul 02, 2026	Authorization Bypass in Kirki <=6.0.11 via Unchecked wp_mail Phishing The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
CVE-2026-12122	Jul 02, 2026	Kirki Freeform <6.0.11 Sensitive Info Exposure via get_single_symbol The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post including unpublished drafts by supplying a sequential WordPress post ID.
CVE-2026-13443	Jul 01, 2026	Stored XSS in Tutor LMS 3.9.13 via Lesson Attachment Title The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Tutor Lms
CVE-2026-57627	Jun 26, 2026	Kirki SSRF in v<=6.0.11 Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.	Kirki
CVE-2026-10736	Jun 18, 2026	Tutor LMS 3.9.11 Authenticated 'data' SQLi for admin users The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Tutor Lms
CVE-2026-22332	Jun 17, 2026	Unauthenticated SQL Injection in Tutor LMS Pro <=3.9.6 Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.	Tutor Lms
CVE-2026-22330	Jun 17, 2026	Unauthenticated LFI in Right Way <=4.0 Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.
CVE-2026-22329	Jun 17, 2026	Skillate <=1.2.10 Unauth XSS Vulnerability (CVE-2026-22329) Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.
CVE-2026-40743	Jun 15, 2026	Unauth BUC in Tutor LMS <=3.9.7 Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.	Tutor Lms
CVE-2026-8206	Jun 02, 2026	Privilege Escalation via Account Takeover in Kirki Freeform Builder 6.0.06.0.6 The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
CVE-2026-8073	May 19, 2026	CVE-2026-8073: Kirki Freeform Plugin <6.0.6 Arbitrary File Deletion via downloadZIP The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
CVE-2026-8096	May 19, 2026	Kirki Plugin 6.0.6: Auth Bypass (Subscriber+) Leak Form Data The Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
CVE-2026-6965	May 13, 2026	Tutor LMS WP Plug IDOR (3.9.9) The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.	Tutor Lms
CVE-2026-5502	Apr 17, 2026	Unauthorized Course Content Manipulation in Tutor LMS 3.9.8 The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.	Tutor Lms