CVE-2026-0548

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0548", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-01T16:58:14.820Z", "datePublished": "2026-01-20T14:26:31.808Z", "dateUpdated": "2026-04-08T16:35:25.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:25.884Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site."}], "title": "Tutor LMS \u2013 eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/tutor/tags/3.9.4/classes/User.php&new_path=/tutor/tags/3.9.5/classes/User.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2026-01-21T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-01T17:15:10.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-20T01:46:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T14:53:15.549458Z", "id": "CVE-2026-0548", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:53:42.335Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T14:53:15.549458Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:53:27.059Z"}}], "cna": {"title": "Tutor LMS \u2013 eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.9.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-21T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-01T17:15:10.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-20T01:46:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/tutor/tags/3.9.4/classes/User.php&new_path=/tutor/tags/3.9.5/classes/User.php"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:25.884Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0548", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:25.884Z", "dateReserved": "2026-01-01T16:58:14.820Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T14:26:31.808Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tutor LMS \u2013 eLearning and online course solution", "vendor": "themeum", "versions": [{"lessThanOrEqual": "3.9.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site."}, {"lang": "es", "value": "El plugin de soluci\u00f3n de eLearning y cursos en l\u00ednea Tutor LMS para WordPress es vulnerable a la eliminaci\u00f3n no autorizada de adjuntos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n 'delete_existing_user_photo' en todas las versiones hasta la 3.9.4, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, eliminen adjuntos arbitrarios en el sitio."}], "id": "CVE-2026-0548", "lastModified": "2026-06-17T10:10:55.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0548", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T14:53:15.549458Z", "version": "2.0.3"}}]}, "published": "2026-01-20T15:20:06.687", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/tutor/tags/3.9.4/classes/User.php&new_path=/tutor/tags/3.9.5/classes/User.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:43:56.799646+00:00", "value": {"mitigation_remediation": ["Update the Tutor LMS plugin to version 3.9.5 or newer, which contains the missing capability check on attachment deletion.", "If an immediate update is not feasible, restrict media library write permissions for subscriber-level roles, either by adjusting WordPress capabilities or by using a security plugin to block file deletion actions for non-owners.", "Enable detailed logging of media library changes so that any unauthorized deletions can be detected and investigated promptly."], "summary": {"action": "Apply patch", "impact": "Unauthorized deletion of attachments leading to data loss"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the Tutor LMS \u2013 eLearning and online course solution plugin for WordPress, versions 3.9.4 and earlier. Users running these plugin versions are exposed to the risk of unauthorized attachment deletion.", "description_and_impact": "The Tutor LMS plugin for WordPress has a missing capability check on the delete_existing_user_photo function. As a result, any authenticated user with subscriber-level access and above can invoke the function to delete arbitrary attachments stored on the site. This flaw is a classic example of a missing authorization flaw, classified as CWE\u2011862, and can lead to loss of course materials, user uploads, and other critical media files, thereby affecting data integrity and availability.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The flaw requires only that the attacker be a legitimate authenticated user with subscriber-level or higher role, with no external dependencies. The vulnerability is not listed in CISA\u2019s KEV catalog. Consequently, the risk is moderate but the likelihood of exploitation is low; however, because any authenticated user could delete any attachment, the potential impact on site content integrity remains significant."}}}}, "created": "2026-01-21T11:19:03.791080+00:00", "updated": "2026-04-15T21:45:14.152676+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}