CVE-2026-1375: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Tutor LMS plugin for WordPress has a security flaw called IDOR (insecure direct object references, where an attacker can access or change data belonging to other users by guessing or manipulating identifiers) in versions up to 3.9.5. Attackers with instructor-level access can modify or delete courses they don't own by changing course ID numbers in bulk action requests, because the plugin doesn't properly check who owns each course.