# Tutor LMS <= 4.2.0 - Unauthenticated Missing Authorization to Enrollment Reactivation and Expiry Reset via Order Success Page

- **ID:** WPSEC-2026-2834
- **Plugin:** Tutor LMS – eLearning and online course solution (`tutor`), https://wordpress.org/plugins/tutor/
- **Affected versions:** from 3.0.0 before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/tutor
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2834/

## Description

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data via the 'order_id' parameter of the order placement success page in all versions up to, and including, 4.2.0. This is due to the handler re-running enrollment and earnings processing for any order ID each time the page loads, without checking that the visitor owns the order or that the order was already processed. This makes it possible for unauthenticated attackers to reactivate cancelled enrollments tied to paid orders, reset enrollment expiry dates, clear the order owner's cart and trigger recalculation of earnings.

## References

- https://wpsec.com/vuln/WPSEC-2026-2834/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2834/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.