Tuturn CVE-2025-64236
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote network vector, no privileges or user interaction, complete impact on all three security dimensions.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a through < 3.6.
AnalysisAI
Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).
Technical ContextAI
The vulnerability stems from CWE-288: Authentication Bypass Using an Alternate Path or Channel. Applications that rely on a single authentication entry point may expose an alternate access path-such as an unprotected AJAX endpoint or a misconfigured direct request handler-that skips the normal credential check. In the Tutorn plugin, this allows an attacker to circumvent login mechanisms entirely. The affected product is a niche WordPress plugin, typically installed on multi-user tutoring or learning management sites, and the flaw likely exists in a core routing or action handler accessible without proper capability checks.
Affected ProductsAI
Tuturn plugin for WordPress, all versions prior to 3.6, as detailed in the Patchstack vulnerability advisory. The advisory links are https://patchstack.com/database/Wordpress/Plugin/tuturn/vulnerability/wordpress-tuturn-plugin-3-6-broken-authentication-vulnerability and https://patchstack.com/database/wordpress/plugin/tuturn/vulnerability/wordpress-tuturn-plugin-3-6-broken-authentication-vulnerability.
RemediationAI
Update the Tuturn plugin to version 3.6 or later immediately, as the fix is incorporated in that release. No vendor-provided workarounds are mentioned; if updating is not immediately feasible, consider deactivating the plugin until the update can be applied, though this will remove all plugin functionality. Monitor Patchstack advisory for any additional guidance.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today