{
 "id": "WPSEC-2026-2834",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2834/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2834/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2834/index.md",
 "title": "Tutor LMS <= 4.2.0 - Unauthenticated Missing Authorization to Enrollment Reactivation and Expiry Reset via Order Success Page",
 "description": "The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data via the 'order_id' parameter of the order placement success page in all versions up to, and including, 4.2.0. This is due to the handler re-running enrollment and earnings processing for any order ID each time the page loads, without checking that the visitor owns the order or that the order was already processed. This makes it possible for unauthenticated attackers to reactivate cancelled enrollments tied to paid orders, reset enrollment expiry dates, clear the order owner's cart and trigger recalculation of earnings.",
 "plugin": {
  "slug": "tutor",
  "name": "Tutor LMS",
  "full_name": "Tutor LMS – eLearning and online course solution",
  "wordpress_org": "https://wordpress.org/plugins/tutor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tutor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tutor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "4.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 4.2.1"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "4.2.1",
 "remediation": "Update to 4.2.1 or later.",
 "fix_released": "2026-11-09T21:34:13+00:00",
 "published": "2026-11-10T21:42:30+00:00",
 "updated": "2026-11-10T00:16:10.936789+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2834/",
  "https://plugins.svn.wordpress.org/tutor/tags/4.2.1/",
  "https://wordpress.org/plugins/tutor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tutor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}