CVE-2024-4279: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Tutor LMS WordPress plugin (up to version 2.7.0) has a security flaw called IDOR (insecure direct object reference, where an attacker can access resources by guessing or manipulating ID numbers) that lets users with Instructor-level permissions delete any course without proper permission checks in the 'tutor_course_delete' function. This happens because the code doesn't validate which courses a user is allowed to delete.