Tutor Lms Elearning And Online Course Solution
Monthly
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with custom-role access or above to append arbitrary SQL to database queries and extract sensitive information. The attack is split across two phases: a malicious payload is stored during quiz abandonment via the wp_ajax_tutor_quiz_abandon AJAX handler, and the injected SQL fires only when a privileged user or Tutor REST API key holder fetches /wp-json/tutor/v1/quiz-attempt-details/{id}. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authenticated administrator. The flaw resides in the withdrawal-request management flow - specifically WithdrawModel.php and withdraw_requests.php - where a 'data' parameter is passed to SQL queries without adequate escaping or parameterization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the data-exposure impact (C:H) is real, and a patched release (3.9.12) is confirmed in the WordPress plugin repository.
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-controlled GET parameter to perform unauthorized operations on other instructors' courses, including deleting lessons, quizzes, assignments, and student data, or modifying course content and grades. The vulnerability stems from the `get_course_id_by()` function unconditionally trusting user-supplied input instead of validating course ownership, bypassing the plugin's primary authorization gate. No public exploit code or active exploitation has been identified at time of analysis.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extract sensitive database information by injecting malicious SQL via the 'date' parameter, which is insufficiently escaped before being interpolated into a SQL fragment passed to $wpdb->prepare(). The vulnerability requires Admin authentication and does not permit data modification or denial of service. CVSS 6.5 reflects confidentiality impact; exploitation is limited to high-privilege authenticated users.
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with custom-role access or above to append arbitrary SQL to database queries and extract sensitive information. The attack is split across two phases: a malicious payload is stored during quiz abandonment via the wp_ajax_tutor_quiz_abandon AJAX handler, and the injected SQL fires only when a privileged user or Tutor REST API key holder fetches /wp-json/tutor/v1/quiz-attempt-details/{id}. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authenticated administrator. The flaw resides in the withdrawal-request management flow - specifically WithdrawModel.php and withdraw_requests.php - where a 'data' parameter is passed to SQL queries without adequate escaping or parameterization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the data-exposure impact (C:H) is real, and a patched release (3.9.12) is confirmed in the WordPress plugin repository.
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-controlled GET parameter to perform unauthorized operations on other instructors' courses, including deleting lessons, quizzes, assignments, and student data, or modifying course content and grades. The vulnerability stems from the `get_course_id_by()` function unconditionally trusting user-supplied input instead of validating course ownership, bypassing the plugin's primary authorization gate. No public exploit code or active exploitation has been identified at time of analysis.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extract sensitive database information by injecting malicious SQL via the 'date' parameter, which is insufficiently escaped before being interpolated into a SQL fragment passed to $wpdb->prepare(). The vulnerability requires Admin authentication and does not permit data modification or denial of service. CVSS 6.5 reflects confidentiality impact; exploitation is limited to high-privilege authenticated users.
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.