Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.
Summary
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Tutor LMS | 2.7.1 to before 4.0.8 | 4.0.8 | Patch available | CNA |
- Tutor LMS VendorUnknown Affected 2.7.1 to before 4.0.8 Fixed in 4.0.8 Patch available CNA
Remediation
- Fix · CNA Tutor LMS (Unknown) Fixed in 4.0.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Tutor LMS 4.0.8
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-58697 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment DisclosurePriority LOW 20
Timeline
- 2026-10-02 Threatist record created from CVE-2026-85569
- 2026-10-03 Alias added: GHSA-55mc-729g-3x85
References
Sources
- CVE-2026-85569 · CVE Program
- CVE-2026-85569 · NVD
- FIRST EPSS
- GHSA-55mc-729g-3x85 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences