The Tutor LMS plugin for WordPress, versions up to and including 2.7.1, contains an authorization bypass vulnerability (CWE-639) via the 'attempt_delete' function. This function lacks proper validation on a user-controlled key, enabling authenticated users with Instructor-level privileges or higher to delete arbitrary quiz attempts. The vulnerability is classified as an insecure direct object reference (IDOR). The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges at the instructor level, no user interaction, unchanged scope, and impact limited to availability (deletion of quiz attempts). No known exploits in the wild or patches are currently documented.

An authenticated attacker with Instructor-level or higher privileges can delete arbitrary quiz attempts, impacting the availability of quiz data. There is no impact on confidentiality or integrity according to the CVSS vector. This could disrupt course progress tracking or assessment records within the affected LMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Instructor-level access to trusted users only and monitor for suspicious deletion activity related to quiz attempts.