The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference vulnerability that allows unauthenticated attackers to modify the billing information of arbitrary users.

This flaw stems from missing authorization checks in the pay_incomplete_order function, which allows an unauthenticated attacker to supply an arbitrary order ID and update the associated user profile. Because the necessary nonce is publicly exposed, attackers can successfully enumerate order IDs and overwrite sensitive billing data for any user with an incomplete manual order.

This vulnerability presents a significant risk to data integrity and user trust. By allowing unauthorized modification of billing profiles, attackers could potentially intercept sensitive information or disrupt legitimate commerce workflows. With a CVSS score of 7.5, this high severity issue requires immediate attention to prevent unauthorized account manipulation and potential downstream fraud.

Immediate Action: Administrators should monitor the vendor advisory and update to the latest patched version immediately upon release. If a patch is not yet available, consider temporarily deactivating the Tutor LMS plugin if the functionality is not business-critical.

Proactive Monitoring: Security teams should monitor server access logs for anomalous POST requests directed at the ecommerce checkout endpoints or unusual patterns of order ID enumeration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the Tutor LMS checkout controller or to restrict access to the affected function based on user roles.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the ease with which an unauthenticated attacker can manipulate user data, organizations utilizing Tutor LMS must prioritize remediation. Ensure that all WordPress plugins are kept up to date and that unnecessary administrative or ecommerce functions are disabled to reduce the overall attack surface.