---
id: CVE-2026-88944
title: >-
  The Tutor LMS – eLearning and online course solution plugin for WordPress is
  vulnerable to authorization bypass in all versions up to, and including, 4.0.8
summary: >-
  The Tutor LMS – eLearning and online course solution plugin for WordPress is
  vulnerable to authorization bypass in all versions up to, and including,
  4.0.8. This is due to the plugin not properly verifying that a user is
  authorized to pe…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: themeum
product: Tutor LMS – eLearning and online course solution
affected:
  - tutor_lms_elearning_and_online_course_solution <= 4.0.8
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88944'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Course.php#L1758
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Course.php#L2055
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Lesson.php#L541
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/User.php#L395
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L3277
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L7481
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Utils.php#L7666
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3700174%40tutor&new=3700174%40tutor
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/7e23fcd0-62b4-460d-9b64-8adbf14bf820?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.0028
epssPercentile: 0.20754
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-19T13:20:38.742532Z'
ingestedAt: '2026-09-19T02:56:32.975Z'
---

## Overview

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.