PT-2025-43711 · WordPress · Tutor Lms Pro

Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-6639

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS Pro versions prior to 3.8.4

Description The Tutor LMS Pro plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of proper validation on a user-controlled key when handling assignment viewing and editing through the tutor assignment submit() function. Authenticated attackers with Subscriber-level access or higher can potentially view and modify assignment submissions belonging to other students.

Recommendations Update Tutor LMS Pro to version 3.8.4 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-6639

Affected Products

Tutor Lms Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-6639 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8dc16ba4-3c2e-43e2-82a0-b742276b9640?source=cve · Note
• https://wordpress.org/plugins/tutor/#developers · Note
• https://twitter.com/CVEnew/status/1981959750796366016 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981976001090388196 · Twitter Post
• https://t.me/CVEtracker/35732 · Telegram Post
• https://t.me/cveNotify/140340 · Telegram Post