Description

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T22:16:46.300Z",
  "pubdate": "2026-08-06T22:16:46.300Z",
  "executiveSummary": "The Tutor LMS WordPress plugin before version 3.9.14 suffers from an access control vulnerability specifically related to improper enrollment verification when restricting access to protected course content. This flaw allows authenticated users with subscriber-level access and above, provided they are enrolled in at least one course on the platform, to bypass authorization checks and view restricted paid lesson, quiz, and assignment content belonging to other courses in which they hold no enrollment.\nThe vulnerability exposes sensitive educational materials to unauthorized low-privileged users, violating the confidentiality and integrity boundaries of paid course offerings. The risk implications include potential revenue loss for course creators and unauthorized data exfiltration of proprietary curriculum materials.\nThe attack capabilities require valid user credentials with at least subscriber-level privileges and active enrollment in a legitimate course. Exploitation relies entirely on manipulating requests to target endpoints of protected course resources without meeting the specific course enrollment criteria.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient authorization logic within the Tutor LMS access control mechanism prior to version 3.9.14. Specifically, the application logic fails to perform granular validation to ensure that the requesting user's enrollment status corresponds directly to the specific course context of the requested protected resource, such as paid lessons, quizzes, and assignments.\nWhen processing requests for protected course content, the application correctly identifies the user as authenticated and verifies that the user possesses a minimum subscriber-level role and holds at least one active course enrollment globally. However, the authorization routine fails to validate whether that specific enrollment grants access to the particular course ID associated with the requested content. This broken object-level authorization (BOLA) flaw permits cross-course content access.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress site using a low-privileged account with subscriber access, ensuring they are enrolled in at least one valid course to satisfy the generalized authentication and global enrollment check. Second, the attacker crafts or intercepts HTTP requests directed toward paid lessons, quizzes, or assignments belonging to other restricted courses. Third, the vulnerable component processes the request, mistakenly trusting the user's general authenticated and enrolled state without verifying specific course associations. Finally, the server responds with the unauthorized protected course content, granting full visibility to materials that should be restricted.\nThe affected component is the access restriction module within the Tutor LMS WordPress plugin handling protected course content. All versions prior to 3.9.14 are vulnerable. The required privileges consist of authenticated access with subscriber-level permissions or higher, coupled with a baseline enrollment in any single course on the platform. Network exposure is standard web-based via HTTP/HTTPS through the WordPress REST API or direct page routing endpoints handled by the plugin."
}