Junglewise Threat Intelligence

CVE-2026-3360: Themeum Tutor LMS IDOR in pay_incomplete_order function

CVE-2026-3360 · Severity: high · CVSS 7.5 · Published 2026-04-10

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Executive brief

Tutor LMS is a popular WordPress plugin used to create and manage online courses. A security flaw allows unauthorized individuals to modify the personal billing information—such as names, emails, and addresses—of other users who have pending orders. This could lead to data corruption and identity-related issues for students and instructors on the platform.

Technical details

The vulnerability exists in the `pay_incomplete_order()` function within the Tutor LMS plugin due to a lack of authentication and authorization checks. The function processes an attacker-supplied `order_id` and updates the billing fields of the associated user profile without verifying if the requester owns the order. Although the system uses a nonce (`_tutor_nonce`) for protection, this nonce is exposed on public frontend pages, allowing unauthenticated attackers to bypass the check. By enumerating or guessing order IDs, an attacker can send a crafted POST request to overwrite sensitive profile data (name, email, phone, address) for any user with an incomplete manual order.

Affected products

  • Themeum Tutor LMS Up to and including 3.9.7

Timeline

  • 2026-04-10: disclosed
  • 2026-04-10: advisory

References