What the vulnerability does
01Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
Explanation of Vulnerability in Simple Terms
02Summary
Tutor LMS versions up to 3.9.7 lack proper authorization checks, allowing unauthenticated attackers to modify course data and settings. An attacker can change course content, pricing, enrollment rules, or other critical attributes without logging in. This affects all installations running the vulnerable version. Update to a version newer than 3.9.7 to resolve the issue.
What an attacker can do
03Attacker Capabilities
Modify course content, settings, pricing, and enrollment rules without authentication.
Potential impact on your site
04Site Impact
Course data and settings can be altered by anyone, disrupting learning experiences and potentially causing financial loss.
Conditions required to exploit
05Prerequisites
Network access to the site; no login or user interaction required.
Key dates
06Disclosure timeline
April 10, 2026
CVE published
April 10, 2026
Record updated
