The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference vulnerability (CWE-639) due to missing authorization checks in the save_course_content_order() method. This method is invoked by the tutor_update_course_content_order AJAX handler without verifying user ownership or capability over the course content being manipulated. Although some authorization checks exist in other branches of the handler, the critical processing of the attacker-controlled tutor_topics_lessons_sorting JSON lacks such checks. Consequently, authenticated users with minimal privileges can reorder course content and reassign lessons across any course, including those owned by administrators. This vulnerability affects all versions up to and including 3.9.7. No patch or official remediation has been published as of the current data.

An attacker with Subscriber-level or higher access can manipulate course content order and lesson assignments across any course, including those owned by administrators. This can lead to unauthorized modification of course structure and content organization, potentially disrupting course delivery and integrity. There is no indication of data disclosure or system compromise. The impact is limited to integrity of course content within the affected LMS plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to course content reordering. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor for a forthcoming patch or official mitigation instructions.