CVE-2026-89333mediumCWE-639

CVE-2026-89333: fallo de gravedad media en themeum Tutor LMS – eLearning and online…

Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

Publicada el

Seguir esta CVE+ Monitorear Tutor LMS – eLearning and online course solution

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.5%
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
themeum · Tutor LMS – eLearning and online course solution
CVEs relacionadas — themeum Tutor LMS – eLearning and online…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10400HIGHTutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterEPSS 83.1%CVE-2024-1751HIGHTutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL InjectionEPSS 3.1%CVE-2026-78175HIGHTutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code ExecutionEPSS 1.1%CVE-2026-16759MEDIUMTutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST ParametersEPSS 0.7%CVE-2026-3360HIGHTutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' ParameterEPSS 0.6%CVE-2024-10393MEDIUMTutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User RegistrationEPSS 0.6%