What is the CVSS score of CVE-2026-3360?

CVE-2026-3360 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3360?

CVE-2026-3360 affects Tutor LMS plugin versions 3.9.7 and earlier, allowing unauthenticated attackers to modify billing profile data (name, email, phone, address) for any WordPress user with an…

How to fix or mitigate CVE-2026-3360?

Within 24 hours: Verify Tutor LMS version across all WordPress installations (use admin dashboard Plugins page or WP-CLI: wp plugin list --field=name,version). Within 7 days: Monitor for patch release from Tutor LMS; implement WordPress security plugin (e.g., Wordfence) with rule-based POST request filtering to block pay_incomplete_order() submissions from unauthenticated sources. Within 30 days: Apply vendor-released patch immediately upon availability to all affected installations (versions ≤3.9.7); conduct audit of order database for unauthorized billing profile modifications created during unpatched period.

WordPress CVE-2026-3360

EUVD-2026-21257 HIGH

Missing Authorization (CWE-862)

2026-04-10 Wordfence

GHSA-hqrg-cfxf-rjg9

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21257

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

HIGH 7.5

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the pay_incomplete_order() function. The function accepts an attacker-controlled order_id parameter and uses it to look up order data, then writes billing fields to the order owner's profile ($order_data->user_id) without verifying the requester's identity or ownership. Because the Tutor nonce (_tutor_nonce) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated order_id.

AnalysisAI

Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.

Technical ContextAI

CWE-862 missing authorization flaw in ecommerce/CheckoutController.php pay_incomplete_order() function. Accepts order_id parameter, retrieves order_data object, then updates user_meta for $order_data->user_id without authentication checks (CVSS PR:N). Tutor nonce mechanism fails to prevent CSRF because nonces are exposed in frontend HTML, enabling replay attacks against IDOR vector.

RemediationAI

Upstream fix available via changeset 3496394 applied to trunk branch; released patched version not independently confirmed at time of analysis. Administrators should monitor Themeum official WordPress plugin repository for version 3.9.8+ release and apply immediately upon availability. Interim mitigation: disable Tutor LMS ecommerce module or restrict plugin to authenticated-only environments if business continuity permits. Audit existing user billing profiles for unauthorized modifications and reset compromised accounts. Review web application firewall rules to block POST requests to /wp-admin/admin-ajax.php with action=pay_incomplete_order from unauthenticated sources. Full technical analysis and indicators of compromise available at https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve and code diff at https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php