IDOR in Tutor LMS <=4.0.8 via student_id
CVE-2026-89333 Published on September 19, 2026
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
Timeline
Vendor Notified
Disclosed 7 days later.
Weakness Type
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2026-89333 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
Products Associated with CVE-2026-89333
Want to know whenever a new CVE is published for Themeum Tutor Lms? stack.watch will email you.
Affected Versions
themeum Tutor LMS – eLearning and online course solution:- Before and including 4.0.8 is affected.