CVE-2026-85569: Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must possess a read-only API key that was issued by an administrator account. The flaw can then allow that key holder to act with the privileges of the issuing administrator.
Which installations are affected?
Tutor LMS versions from 2.7.1 up to, but not including, 4.0.8 are affected. The provided information does not state whether read-only API keys are enabled or created by default.
What should be prioritized if an immediate upgrade is not possible?
Identify and revoke or rotate read-only API keys issued by administrator accounts, since possession of such a key is the stated prerequisite for exploitation. Limit distribution of those credentials until the plugin can be updated to 4.0.8 or later.