CyberRota Analysis
AI-GeneratedThe Tutor LMS WordPress plugin prior to version 3.9.13 contains a vulnerability that allows authenticated users with instructor-level access to overwrite any post or page on the site, including those owned by administrators, due to improper verification of user permissions. This could lead to unauthorized content manipulation and potential site takeover. WordPress site administrators and users of the Tutor LMS plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.