Tutor LMS CVE-2025-11564

Exploitation requires the target site to be running Tutor LMS's native e-commerce/order functionality with a webhook-based payment gateway (the referenced code path is the PayPal gateway's verifyAndCreateOrderData), and the attack specifically abuses requests where payment_type is set to 'recurring', which is the code path missing the capability/signature check. No authentication is required (CVSS PR:N confirms unauthenticated). The practical limiting factor is configuration: sites that do not use Tutor LMS paid checkout / the affected payment gateway are not exploitable, so despite the network-unauthenticated vector the real-world exposure is confined to e-commerce-enabled installations on version ≤3.8.3.

This is a moderate, real-but-narrow business-logic flaw rather than a top-tier emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects a network-reachable, unauthenticated, low-complexity attack whose only impact is a LOW integrity effect - no confidentiality or availability loss. The EPSS score of 0.29% (20th percentile) is low and is consistent with this NOT being in the CISA KEV catalog and no public exploit code being identified, so there is no signal of active or widespread exploitation. No SSVC decision data was provided. The signals are mutually consistent (modest CVSS, low EPSS, no KEV, no POC), so there is no contradiction to flag. The practical significance is financial/fraud rather than system compromise: an attacker can forge webhook requests to mark e-commerce orders as paid, bypassing payment verification, which matters for sites selling courses but does not grant code execution, data theft, or site takeover. Priority should be moderate - patch during normal maintenance for sites that actually run the Tutor LMS native e-commerce/PayPal checkout, lower for sites not using paid enrollment.

An attacker targeting a WordPress site running Tutor LMS with its PayPal e-commerce checkout enabled sends a forged webhook HTTP request with payment_type set to 'recurring' to the verifyAndCreateOrderData handler, which skips the capability/signature check for that path. The order is marked as paid without any real payment, granting the attacker free access to the purchased course or product. No authentication or user interaction is required; however, no public exploit code has been identified at time of analysis.