CVE-2026-6965 is an authorization bypass vulnerability in the Tutor LMS WordPress plugin (up to version 3.9.9). The vulnerability stems from the 'get_course_id_by()' function trusting a user-controlled 'course' GET parameter as the authoritative course ID for ownership verification. This parameter is then used by 'can_user_manage()', the sole authorization gate for instructor-level operations. Because the authorization check is performed against the attacker-controlled course ID rather than the actual content owner, authenticated instructors can manipulate or delete other instructors' course content, including lessons, quizzes, assignments, announcements, and student data.

An attacker with instructor-level privileges can bypass authorization controls to perform unauthorized operations on other instructors' course content. This includes permanent deletion of lessons, assignments, quizzes (with cascading deletion of student attempts), and other course materials, as well as unauthorized creation or modification of content and manipulation of student quiz grades. The vulnerability compromises the integrity and availability of course content but does not impact confidentiality directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict instructor-level access to trusted users only and monitor for suspicious activity related to course content management. Avoid exposing the vulnerable plugin in environments where untrusted instructors have access.