Tutor LMS <= 4.2.0 - Unauthenticated Missing Authorization to Enrollment Reactivation and Expiry Reset via Order Success Page

ID

WPSEC-2026-2834

Plugin

Tutor LMS – eLearning and online course solution (tutor)

Affected

from 3.0.0 before 4.2.1

Remediation

Update to 4.2.1 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-862

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10

Attack surface

Tutor LMS on WPSec AttackSurface

Fix released

2026-11-09

Published

2026-11-10

Description

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data via the 'order_id' parameter of the order placement success page in all versions up to, and including, 4.2.0. This is due to the handler re-running enrollment and earnings processing for any order ID each time the page loads, without checking that the visitor owns the order or that the order was already processed. This makes it possible for unauthenticated attackers to reactivate cancelled enrollments tied to paid orders, reset enrollment expiry dates, clear the order owner's cart and trigger recalculation of earnings.

References

• https://wpsec.com/vuln/WPSEC-2026-2834/
• https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
• https://wordpress.org/plugins/tutor/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS