The Tutor LMS plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the tutor_update_course_content_order() function. While the function validates a nonce to protect against CSRF, it fails to verify if the user has permission to manage course content when the 'content_parent' parameter is absent. This allows authenticated users with subscriber-level privileges or higher to alter the wp_posts table by detaching lessons from topics, moving lessons, and changing course content order without authorization. The vulnerability affects versions up to and including 3.9.8.

An attacker with subscriber-level or higher access can manipulate the structure of any course on the affected WordPress site by detaching lessons from topics, moving lessons between topics, and modifying the menu order of course content. This leads to unauthorized modification of course content order, potentially disrupting the learning experience. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — no official fix or patch is currently available according to the vendor advisory. Users should monitor the vendor's communications for updates. Until a fix is released, restrict subscriber-level user capabilities where possible and review user roles to limit access to course content management functions.