PT-2025-43712 · WordPress · Tutor Lms

Published 2025-10-25 · Updated 2025-10-25 · CVE-2025-6680

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.8.4

Description The Tutor LMS plugin for WordPress is affected by a sensitive information exposure issue. Authenticated attackers with tutor-level access or higher can view assignments from courses they are not teaching, potentially exposing sensitive information contained within those assignments.

Recommendations Update Tutor LMS to version 3.8.4 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-6680

Affected Products

Tutor Lms

References · 7

• https://osv.dev/vulnerability/CVE-2025-6680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6680 · Security Note
• https://plugins.trac.wordpress.org/changeset/3382577/tutor/trunk/templates/dashboard/assignments/review.php?old=3249440&old_path=tutor%2Ftrunk%2Ftemplates%2Fdashboard%2Fassignments%2Freview.php · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/1b8d88e4-a9dc-4740-b836-99f730beefcb?source=cve · Note
• https://twitter.com/CVEnew/status/1981959759411511612 · Twitter Post
• https://t.me/CVEtracker/35733 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1981981120708186141 · Twitter Post