CVE-2026-18439: Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids[], and deletedanswerids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level courseid, topicid, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::savequestions(), QuizBuilder::savequestionanswers(), and QuizBuilder::handledelete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with Instructor-level access or higher can exploit it. The attacker does not need administrator access, but must be able to submit requests to the tutor_quiz_builder_save AJAX action.
What can an attacker change or delete?
An attacker can overwrite and re-parent quiz questions and answers associated with quizzes, topics, or courses managed by other instructors or administrators. They can also delete arbitrary quiz question and answer rows by supplying nested identifiers in the payload.
Does authorization of the course or topic prevent exploitation?
No. The handler validates the top-level course_id, topic_id, and, when present, payload ID, but does not verify that nested question_id, answer_id, deleted_question_ids, or deleted_answer_ids belong to content the requester is allowed to manage.
How can defenders identify potential exploitation?
Review requests to the tutor_quiz_builder_save AJAX action from Instructor-level or higher accounts, particularly payloads containing question_id, answer_id, deleted_question_ids, or deleted_answer_ids that reference content outside the requester’s authorized course, topic, or quiz. Also investigate unexpected question or answer edits, re-parenting, and deletions affecting other instructors’ or administrators’ quizzes.