Executive brief
Tutor LMS is a popular WordPress plugin used to create and manage online courses. A security flaw allows unauthorized individuals to modify the personal billing information—such as names, emails, and addresses—of other users who have pending orders. This could lead to data corruption and identity-related issues for students and instructors on the platform.
Technical details
The vulnerability exists in the `pay_incomplete_order()` function within the Tutor LMS plugin due to a lack of authentication and authorization checks. The function processes an attacker-supplied `order_id` and updates the billing fields of the associated user profile without verifying if the requester owns the order. Although the system uses a nonce (`_tutor_nonce`) for protection, this nonce is exposed on public frontend pages, allowing unauthenticated attackers to bypass the check. By enumerating or guessing order IDs, an attacker can send a crafted POST request to overwrite sensitive profile data (name, email, phone, address) for any user with an incomplete manual order.
Affected products
- Themeum Tutor LMS Up to and including 3.9.7
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Tutor.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php
- https://plugins.trac.wordpress.org/browser/tutor/trunk/ecommerce/CheckoutController.php
- https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve