WordPress Plugin Vulnerabilities

Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

Description

The plugin does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.

Proof of Concept

Affects Plugins

Plugin icon
tutor
Fixed in 4.0.8

References

CVE
CVE-2026-85569

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
ddbae988-37a2-4fb7-a813-bbc708f1f1c9

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2026-02-07
Title
JAY Login & Register < 2.6.04 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
Published
2026-07-15
Title
WPFunnels < 3.12.9 - Funnel Manager+ Privilege Escalation via 'group_id' Path Parameter
Published
2024-12-11
Title
KH Easy User Settings <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation
Published
2025-07-11
Title
Nokri < 1.6.4 - Subscriber+ Privilege Escalation
Published
2026-07-22
Title
MDJM Event Management < 1.7.8.5 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers