CVE-2026-3371: 
WordPress vulnerability analysis and mitigation

CVE-2026-3371 is an Insecure Direct Object Reference (IDOR) vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress, affecting all versions up to and including 3.9.7. The flaw allows authenticated attackers with Subscriber-level access or above to manipulate course content structure — including reordering lessons, detaching lessons from topics, and reassigning lessons between topics — across any course, including those owned by administrators. It was published on April 11, 2026, with a patch released in version 3.9.8. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-639: Authorization Bypass Through User-Controlled Key) in the save_course_content_order() private method within classes/Course.php. This method is called unconditionally by the tutor_update_course_content_order AJAX handler, which processes attacker-supplied tutor_topics_lessons_sorting JSON data without verifying ownership or user capability. While the handler's content_parent branch does include a can_user_manage() check, the save_course_content_order() invocation path bypasses this check entirely, allowing any authenticated user to supply arbitrary topic and lesson IDs via a crafted AJAX request (GitHub Advisory).

Successful exploitation allows authenticated low-privilege users (Subscriber-level or above) to arbitrarily reorder course content, detach lessons from their assigned topics, and reassign lessons between topics in any course on the WordPress site — including courses owned by administrators. While there is no confidentiality or availability impact, the integrity of course content across the entire platform can be disrupted, potentially degrading the learning experience and undermining course structure for all enrolled students (GitHub Advisory).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.028% (0.000280), placing it in a very low probability tier for near-term exploitation. The vulnerability requires only a valid WordPress account at Subscriber level or above, with no user interaction needed, making it relatively low-friction for any registered site user to attempt. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a WordPress site running the Tutor LMS plugin at version 3.9.7 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/tutor/readme.txt) or observing LMS-specific page structures.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level (or higher) account on the target WordPress site.
3. Enumerate course content IDs: Browse existing courses to identify topic IDs and lesson IDs. These are typically exposed in page source, REST API responses, or course builder interfaces.
4. Craft malicious AJAX request: Construct a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action tutor_update_course_content_order and a manipulated tutor_topics_lessons_sorting JSON payload containing arbitrary topic and lesson IDs from any course.
5. Submit the request: Send the crafted request while authenticated. The save_course_content_order() method processes the payload without ownership or capability verification, applying the attacker-specified ordering and topic assignments.
6. Achieve content manipulation: Lessons are detached from their original topics, reordered, or reassigned to different topics in the targeted course, disrupting course structure for all users (GitHub Advisory).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=tutor_update_course_content_order originating from low-privilege user accounts or unexpected IP addresses.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with the tutor_update_course_content_order action from Subscriber-level users; unexpected changes to course content ordering timestamps in the database.
• Application: Unexplained reordering of lessons within courses, lessons appearing under incorrect topics, or lessons detached from all topics — especially in admin-owned courses not recently edited by administrators.

The vulnerability is patched in Tutor LMS version 3.9.8. All users running version 3.9.7 or earlier should upgrade to 3.9.8 or later immediately via the WordPress plugin dashboard or the WordPress plugin repository. As a post-upgrade measure, administrators should audit course content structure for unauthorized modifications and review user roles to ensure the principle of least privilege is applied. Monitoring AJAX requests targeting the tutor_update_course_content_order handler can help detect any exploitation attempts (GitHub Advisory).

Sucuri included CVE-2026-3371 in their April 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention. Wordfence also tracked the vulnerability in their threat intelligence database. General community reaction has been muted given the medium severity rating and lack of public exploit code.