CVE-2026-88944 is an authorization bypass vulnerability (CWE-862) in the Tutor LMS WordPress plugin versions up to 4.0.8. The plugin fails to properly verify user authorization before allowing deletion of posts via wp_delete_post($id, true). Authenticated attackers with subscriber-level privileges can exploit this by first triggering the profile-photo upload to create an authored attachment post, then creating a Tutor topic linked to that attachment, and finally invoking the lesson deletion handler to delete arbitrary posts such as pages, courses, quizzes, or WooCommerce products.

An attacker with subscriber-level access or higher can permanently delete arbitrary WordPress posts, including critical content like courses, quizzes, pages, and WooCommerce products. This can lead to data loss and disruption of the eLearning platform's content integrity. There is no indication of confidentiality or availability impact beyond the deletion of content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious deletion activities related to Tutor LMS content. Avoid granting unnecessary privileges to low-level users.