CVE-2026-1375 describes an Insecure Direct Object Reference (IDOR) vulnerability in the Tutor LMS WordPress plugin (up to version 3.9.5). The issue arises from missing authorization checks in the functions course_list_bulk_action(), bulk_delete_course(), and update_course_status(), allowing authenticated users with Instructor-level privileges or above to perform unauthorized modifications or deletions of arbitrary courses by manipulating course identifiers in bulk action requests.

Exploitation allows authenticated users with at least Instructor-level access to modify or delete courses they do not own, potentially disrupting course content and availability. The vulnerability does not affect confidentiality but impacts integrity and availability of course data, reflected in the CVSS vector (Integrity: High, Availability: High). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Instructor-level access to trusted users only and monitor for suspicious bulk action requests involving course IDs. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.