{"id":"CVE-2026-89333","aliases":["EUVD-2026-83467","GHSA-fjhh-mxpw-32j7"],"status":"published","title":"Tutor LMS \u003c= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00464,"percentile":0.40701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-19T02:27:07Z","modified":"2026-09-21T13:33:33Z","products":[{"vendor":"themeum","product":"tutor lms – elearning and online course solution"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244051ef-5357-4b16-b690-46c8fea56847?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/templates/user-profile.php#L132"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/templates/user-profile.php#L21"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/templates/user-profile.php#L137"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Utils.php#L2841"},{"url":"https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Template.php#L503"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3700174%40tutor\u0026new=3700174%40tutor"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89333"},{"url":"https://github.com/advisories/GHSA-fjhh-mxpw-32j7"}],"sources":{"cve":[{"id":"CVE-2026-89333","title":"Tutor LMS \u003c= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.","status":"published","published":"2026-09-19T02:27:07.977Z","modified":"2026-09-19T14:01:27.738Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:55.176387Z"}],"euvd":[{"id":"EUVD-2026-83467","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.","status":"published","published":"2026-09-19T02:27:07Z","modified":"2026-09-19T14:01:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:06.658724Z"}],"ghsa":[{"id":"GHSA-fjhh-mxpw-32j7","title":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to...","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.","status":"published","published":"2026-09-19T03:32:03Z","modified":"2026-09-19T03:32:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-89333","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.","status":"published","published":"2026-09-19T03:17:16.743Z","modified":"2026-09-21T13:33:33.387Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:50.043898Z"}]}}