The Tutor LMS plugin for WordPress versions up to 3.9.8 contains a missing authorization vulnerability (CWE-862) in the tutor_update_course_content_order() function. While the function validates a nonce to protect against CSRF, it fails to verify if the user has the necessary permissions to manage course content unless the 'content_parent' parameter is included. If this parameter is omitted, the function calls save_course_content_order() without any authorization checks, allowing authenticated users with subscriber-level or higher access to manipulate the wp_posts table. This enables unauthorized modification of course content order and structure, such as detaching lessons from topics or moving lessons between topics.

The vulnerability allows authenticated users with minimal privileges (subscriber-level or above) to disrupt the structure of any course by manipulating course content order and relationships. This can lead to unauthorized modification of course content organization, potentially degrading the learning experience or causing confusion for legitimate users. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been identified.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users should monitor the vendor's communications for updates and apply any official patches once released. Until then, consider restricting subscriber-level access or implementing additional access controls to limit who can interact with course content ordering functions.