The Tutor LMS plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability due to missing authorization checks in the save_course_content_order() private method. Although the AJAX handler tutor_update_course_content_order performs a can_user_manage() check in one branch, the method that processes the tutor_topics_lessons_sorting JSON data does not verify user ownership or capabilities. This flaw enables authenticated users with Subscriber-level privileges or higher to reorder lessons, detach them from topics, and reassign lessons across courses, including those owned by administrators, by sending crafted AJAX requests with manipulated topic and lesson IDs.

The vulnerability allows unauthorized modification of course content order and lesson-topic assignments by authenticated users with low privileges. There is no impact on confidentiality or availability, but the integrity of course content can be compromised, potentially disrupting course structure and user experience.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious AJAX requests related to course content ordering. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor for an official patch or temporary mitigation.