What is the CVSS score of EUVD-2026-21257?

EUVD-2026-21257 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-21257?

Within 24 hours: Verify Tutor LMS version across all WordPress installations (use admin dashboard Plugins page or WP-CLI: wp plugin list --field=name,version). Within 7 days: Monitor for patch release from Tutor LMS; implement WordPress security plugin (e.g., Wordfence) with rule-based POST request filtering to block pay_incomplete_order() submissions from unauthenticated sources. Within 30 days: Apply vendor-released patch immediately upon availability to all affected installations (versions ≤3.9.7); conduct audit of order database for unauthorized billing profile modifications created during unpatched period.

Tutor Lms Elearning And Online Course Solution EUVD-2026-21257

| CVE-2026-3360 HIGH

Missing Authorization (CWE-862)

2026-04-10 Wordfence

GHSA-hqrg-cfxf-rjg9

WordPress Authentication Bypass Tutor Lms Elearning And Online Course Solution Wordpress Plugin Themeum

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access vulnerable pay_incomplete_order() endpoint
Delivery

Supply arbitrary order_id parameter
Exploit

Bypass missing authentication checks
Execution

Modify victim's billing profile fields
Impact

Persist unauthorized account data changes

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Tutor LMS plugin versions ≤3.9.7 for WordPress. Remote unauthenticated attacker can exploit the `pay_incomplete_order()` function by crafting a request with an arbitrary `order_id` parameter. The exposed `_tutor_nonce` on public frontend pages enables CSRF exploitation. No victim interaction required.
Impact	High-priority unauthenticated IDOR affecting all Tutor LMS versions ≤3.9.7. Attackers can modify any user's billing profile (name, email, address) via exposed nonce on public pages and enumerated order IDs. No authentication required. Impact limited to integrity; no data exfiltration or availability loss. Blast radius depends on incomplete order prevalence.
Exploit ScenarioDerived	Attacker obtains exposed `_tutor_nonce` from public Tutor page, enumerates `order_id` values via POST requests to `pay_incomplete_order()`, and overwrites target user billing fields. Single HTTP request per victim; no credentials needed. No public exploit code identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.

RemediationAI

Upstream fix available via changeset 3496394 applied to trunk branch; released patched version not independently confirmed at time of analysis. Administrators should monitor Themeum official WordPress plugin repository for version 3.9.8+ release and apply immediately upon availability. Interim mitigation: disable Tutor LMS ecommerce module or restrict plugin to authenticated-only environments if business continuity permits. Audit existing user billing profiles for unauthorized modifications and reset compromised accounts. Review web application firewall rules to block POST requests to /wp-admin/admin-ajax.php with action=pay_incomplete_order from unauthenticated sources. Full technical analysis and indicators of compromise available at https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve and code diff at https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php

Affected VersionsENISA

Tutor LMS – eLearning and online course solution 0 ≤3.9.7

Affected Packages

euvd tutor_lms_elearning_and_online_course_solution no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-862 missing authorization flaw in ecommerce/CheckoutController.php pay_incomplete_order() function. Accepts order_id parameter, retrieves order_data object, then updates user_meta for $order_data->user_id without authentication checks (CVSS PR:N). Tutor nonce mechanism fails to prevent CSRF because nonces are exposed in frontend HTML, enabling replay attacks against IDOR vector.

Know when Tutor Lms Elearning And Online Course Solution gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the pay_incomplete_order() function. The function accepts an attacker-controlled order_id parameter and uses it to look up order data, then writes billing fields to the order owner's profile ($order_data->user_id) without verifying the requester's identity or ownership. Because the Tutor nonce (_tutor_nonce) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated order_id.

Executive ViewAI

Why It Matters

CVE-2026-3360 affects Tutor LMS plugin versions 3.9.7 and earlier, allowing unauthenticated attackers to modify billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order. This vulnerability directly exposes customer data integrity and could facilitate account takeover, identity fraud, or supply chain manipulation for organizations relying on Tutor LMS for course management and payment processing.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement Web Application Firewall (WAF) rules to restrict POST requests to pay_incomplete_order() endpoint to authenticated users only; (2) Disable manual order functionality in Tutor LMS settings if not operationally critical; (3) Apply WordPress security hardening to limit nonce exposure on public-facing pages; (4) Implement regular database integrity audits monitoring billing profile modification timestamps for suspicious activity; (5) Require email confirmation for any billing profile changes via secondary verification workflow outside Tutor LMS.

Threat Intelligence Overview

EPSS Score

0.1%

Top 72% exploitable

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.