Security Alert Summary
The Tutor LMS – eLearning and online course solution plugin for WordPress contains an Insecure Direct Object Reference vulnerability that can allow unauthenticated attackers to overwrite billing profile fields for users with incomplete manual orders. The issue stems from missing authentication and authorization checks in a server-side function that accepts an attacker-controlled order identifier.
CVE Details
- CVE ID: CVE-2026-3360
- Affected component: Tutor LMS – eLearning and online course solution plugin for WordPress
- Affected versions: All versions up to, and including, 3.9.7
- Published: April 10, 2026 at 02:16:03 AM
- Last modified: April 10, 2026 at 02:16:03 AM
- CVSS v3.1 base score: 7.5
- CVSS v3.1 severity: HIGH
- CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N); unauthenticated network access (AV:N)
- Primary impact: Confidentiality: None; Integrity: High; Availability: None
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability exists because the pay_incomplete_order() function accepts an attacker-controlled order_id parameter, looks up order data, and writes billing fields to the order owner’s profile ($order_data->user_id) without verifying the requester’s identity or ownership of the order. The Tutor nonce (_tutor_nonce) is exposed on public frontend pages, which an attacker can reuse in a crafted POST request. An attacker who can guess or enumerate a valid order_id for a user with an incomplete manual order can submit a request that overwrites billing details such as name, email, phone, and address for that user.
This is an integrity-impacting issue: it allows modification of user billing data, but does not, based on the provided information, indicate direct disclosure of confidential data or availability disruption.
How This Could Impact Your Website
Consider a site where the site owner manages course purchases, internal staff process orders, and external contractors or contributors assist with content. If an attacker overwrites billing email or phone fields for a user who has an incomplete manual order, order notifications or follow-up messages could be redirected, and contact records become unreliable. This can increase the risk of targeted phishing or social engineering because attackers may cause communications to be sent to addresses or numbers they control or to manipulated contact records.
In practice, affected users may receive incorrect order confirmations, invoices may be associated with incorrect contact details, or outreach intended for a legitimate user may be diverted. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and users who can create orders.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit plugins with public frontend endpoints that accept POST requests.
- Monitor site activity and logs for unusual POST requests, unexpected changes to user profiles, and order-related changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Tutor.php#L563
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L1059
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L108
- https://plugins.trac.wordpress.org/browser/tutor/trunk/ecommerce/CheckoutController.php#L1059
- https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve
