EUVD-2026-43290
GHSA-99wj-j8x8-6wwx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network, low-complexity abuse by an authenticated subscriber (PR:L); confidentiality rated L as the exposed asset is course content not credentials, integrity L for unauthorized enroll/complete, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
Articles & Coverage 1
AnalysisAI
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass paid/private-course access controls when the Droip or Kirki page-builder integration is active. Because these integration handlers omit the enrollment, purchase, and private-course capability checks enforced in the core course handler, low-privileged accounts can self-enroll in paid or private courses, read otherwise-restricted content, and mark arbitrary courses complete. Reported by WPScan with publicly available exploit detail and a vendor patch released; no active exploitation is currently listed in CISA KEV.
Technical ContextAI
Tutor LMS is a widely used learning-management plugin for WordPress that gates course access behind enrollment, purchase, and private-course capability checks. The flaw is a classic Missing/Improper Authorization issue (CWE-862 / CWE-285): the alternate code paths added for the Droip and Kirki page-builder integrations reimplement course actions but fail to re-apply the authorization checks that the canonical core course handler performs. As a result, the same actions (enroll, view, complete) are reachable through the integration endpoints without the guard logic. The CPE (cpe:2.3:a:unknown:tutor_lms:*) confirms the affected component is the Tutor LMS application itself rather than the third-party builders, though exposure is contingent on those integrations being enabled.
RemediationAI
Upgrade Tutor LMS to version 3.9.13 or later, which restores the enrollment, purchase, and private-course capability checks in the Droip and Kirki integration paths (Vendor-released patch: 3.9.13). If immediate patching is not possible, deactivate the Droip and/or Kirki page-builder integration in Tutor LMS to remove the vulnerable code paths entirely, accepting the trade-off that any course pages built with those builders will lose that integration's functionality until patched. As an additional interim control, restrict or disable open user self-registration (or tighten the default new-user role away from subscriber) to shrink the pool of authenticated attackers, recognizing this reduces legitimate self-service signup. Consult the WPScan advisory (https://wpscan.com/vulnerability/fcd43a87-8721-4455-b014-ac81d53fc671/) for exploit specifics before validating the fix.
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers o
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Several AJAX endpoints in the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7.7 were unprot
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowi
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-le
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS - eLearning and online course soluti
The tutor_place_rating AJAX action from the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS - eLearning and online course solution WordPress
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS - eLearning and online course solution Wor
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today