What is the CVSS score of CVE-2025-32223?

CVE-2025-32223 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Tutor Lms are affected by CVE-2025-32223?

CVE-2025-32223 presents notable security risk, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-32223?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Tutor Lms CVE-2025-32223

EUVD-2025-208856 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-19 Patchstack

Authentication Bypass Tutor Lms

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 08:30 euvd

EUVD-2025-208856

Analysis Generated

Mar 19, 2026 - 08:30 vuln.today

CVE Published

Mar 19, 2026 - 08:05 nvd

MEDIUM 6.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 3.9.4.

AnalysisAI

An authorization bypass vulnerability exists in Themeum Tutor LMS through version 3.9.4 that allows authenticated users to access resources they should not have permission to view through user-controlled keys in the access control mechanism. This Insecure Direct Object Reference (IDOR) vulnerability affects all Tutor LMS installations up to and including version 3.9.4, enabling an attacker with low privileges to read sensitive data by manipulating object identifiers. The vulnerability has a CVSS score of 6.5 reflecting moderate severity with high confidentiality impact, and while no KEV or widespread POC exploitation has been publicly confirmed, the attack requires only network access and valid authentication credentials.

Technical ContextAI

This vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a weakness where applications use user-supplied input directly as an authorization decision point without proper server-side validation. In the context of Themeum Tutor LMS (identified via CPE cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:*:*:*), the vulnerability manifests as an Insecure Direct Object Reference (IDOR) flaw affecting access control security levels. The LMS fails to properly validate whether the authenticated user has legitimate authorization to access course materials, student records, or other protected resources when object identifiers (such as course IDs, student IDs, or lesson IDs) are manipulated in API requests or URL parameters. Rather than enforcing server-side authorization checks based on user roles and enrolled courses, the application relies on client-controlled keys or parameters, allowing privilege escalation within the authentication context.

RemediationAI

Immediately upgrade Themeum Tutor LMS to a version released after 3.9.4, which should contain authorization bypass fixes. Visit the official Tutor LMS plugin page in the WordPress plugin directory or the vendor's security advisory at https://patchstack.com/database/wordpress/plugin/tutor/ for the specific patched version. Until patching is completed, implement server-side access control verification in the WordPress environment by using role-based capability checks for all course and student data access, ensure that no object identifiers are directly exposed to users without validation, and restrict plugin functionality to trusted administrators via WordPress user role management. Additionally, review WordPress user account access logs and disable accounts with unnecessary privilege levels to minimize the attack surface for credential-based exploitation.