CVE-2026-6965: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Tutor LMS plugin for WordPress (versions up to 3.9.9) has a vulnerability where it trusts user input (IDOR, or insecure direct object reference, which happens when an app doesn't properly check if a user should access data before showing it). An authenticated instructor can manipulate a parameter to gain unauthorized access to other instructors' courses and perform damaging actions like deleting lessons, quizzes, and student data, or modifying grades.