d3kc4rt1/CVE-2026-1375

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing an IDOR vulnerability (CVE-2026-1375) in the Tutor LMS WordPress plugin. It details the root cause, affected functions, and manual exploitation steps, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file documenting CVE-2026-1375, an IDOR vulnerability in the Tutor LMS WordPress plugin. It contains no executable code, no obfuscated payloads, no instructions to run software, and no concealed behavior. The content is a standard vulnerability disclosure with manual exploitation steps that describe normal exploit behavior against the stated target.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
LanguagesEnglish
Target softwareTutor LMS WordPress Plugin
Attack typesInsecure Direct Object Reference (IDOR)Authorization Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a vulnerability summary, root cause analysis, and manual exploitation steps. It does not include any executable code, scripts, or automated checks; it is purely a technical description, making it a writeup.

README.md:1-67

Requirements

  • Authenticated as a Tutor Instructor on a WordPress site with the vulnerable Tutor LMS plugin (<= 3.9.5).README.md:7
  • Knowledge of a target course ID belonging to another instructor.README.md:49

Observed behavior

  • Describes intercepting a bulk action request and modifying the 'id' and 'status' parameters to affect a course not owned by the attacker.README.md:50-55
  • States the server responds with success and the victim's course is moved to trash.README.md:56
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
CVE-2026-1375The README documents an IDOR vulnerability in Tutor LMS plugin, including manual PoC steps.README.md:1-67
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file; no source code, exploit scripts, or scanner code is present.
  • The manual exploitation steps describe a process but do not constitute executable code.
  • Only the README.md file was provided; no other repository files were inspected. The analysis scope confirms complete coverage of the selected text but no other files were available.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1