Tutor LMS CVE-2025-6680

Exploitation requires the attacker to already possess an authenticated account with tutor-level (instructor) access or higher on the Tutor LMS site, and the deployment must host courses taught by multiple instructors so that there exist assignments belonging to courses the attacker does not teach. The limiting factors are significant: single-instructor sites have little to expose, and the vulnerability grants only read access to assignment content (C:L) - no modification, deletion, or privilege escalation. The exposed data's sensitivity depends entirely on what students submit in assignments. This is not remotely exploitable by unauthenticated users.

This is a low-to-moderate priority issue that CVSS (4.3, Medium) correctly characterizes as limited. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N shows a network-reachable but authenticated flaw (PR:L) with only low confidentiality impact and no integrity or availability impact - consistent with a horizontal access-control/information-disclosure bug (CWE-284) rather than a system-compromise vulnerability. EPSS reinforces low real-world urgency at 0.22% (11th percentile), and the flaw is NOT in CISA KEV and has no identified public exploit, so there is no evidence of active exploitation. The one caveat worth cross-referencing: PR:L requires an attacker to already hold a tutor-level account on the target site, which meaningfully constrains who can exploit this despite the AV:N network vector - the practical attack surface is insiders or attackers who have obtained instructor credentials, not anonymous internet attackers. No SSVC decision data was supplied. Net: a genuine data-exposure bug worth patching in the normal maintenance cycle, not an emergency.

An attacker who holds (or has compromised) a tutor/instructor-level account on a WordPress site running Tutor LMS logs into the instructor dashboard and requests the assignment-review view for a course they are not assigned to teach, reading student submissions and any sensitive content they contain. No public exploit code has been identified, and the attack requires valid tutor-level authentication and only exposes assignment data (no write access or site takeover).