PT-2026-31846 · Themeum · Tutor Lms – Elearning/Online Course Solution

Supakiad S · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-3360

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the pay incomplete order() function. The function accepts an attacker-controlled order id parameter and uses it to look up order data, then writes billing fields to the order owner's profile ($order data->user id) without verifying the requester's identity or ownership. Because the Tutor nonce ( tutor nonce) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated order id.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3360

Affected Products

Tutor Lms – Elearning/Online Course Solution

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3360 · Security Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L1059 · Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L108 · Note
• https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php · Note
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Tutor.php#L563 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/tutor/trunk/ecommerce/CheckoutController.php#L1059 · Note