CVE-2026-3371

OVERVIEW CVE-2026-3371 is an Insecure Direct Object Reference vulnerability in Tutor LMS, a WordPress plugin for eLearning and online course management, affecting all versions up to and including 3.9.7. The vulnerability exists in the save_course_content_order() method, which processes course content modifications without proper authorization checks, allowing attackers to manipulate lesson-topic relationships and course structures. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.3 (Medium severity) and requires low attack complexity over a network with only low privilege requirements. An authenticated attacker with Subscriber-level access or higher can exploit this flaw by sending a crafted AJAX request with manipulated lesson and topic IDs. The impact is limited to integrity violations, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons across any course, including those owned by administrators, while maintaining confidentiality and availability. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00011 indicates minimal statistical probability of exploitation, and the vulnerability remains inactive on threat intelligence hot lists. No publicly available exploit code has been widely circulated, though the straightforward nature of the AJAX manipulation suggests exploitation would be relatively straightforward for motivated threat actors with access to vulnerable installations.