CVE-2025-11564

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323	Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve	Product Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:themeum:tutor_lms:*:*:*:*:free:wordpress:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El plugin de solución de eLearning y cursos en línea Tutor LMS para WordPress es vulnerable a la modificación no autorizada de datos debido a una comprobación de capacidad faltante al verificar firmas de webhook en la función 'verifyAndCreateOrderData' en todas las versiones hasta la 3.8.3, inclusive. Esto permite a atacantes no autenticados eludir la verificación de pagos y marcar pedidos como pagados al enviar solicitudes de webhook falsificadas con 'payment_type' establecido en 'recurring'.

Information

Published : 2025-10-25 06:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-11564

Mitre link : CVE-2025-11564

CVE.ORG link : CVE-2025-11564

JSON object : View

Products Affected

themeum

tutor_lms

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-11564", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11564", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:48:45.707365Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.3"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-25T06:15:35.307", "references": [{"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve", "tags": ["Product", "Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the \"verifyAndCreateOrderData\" function \r\nin all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'."}, {"lang": "es", "value": "El plugin de soluci\u00f3n de eLearning y cursos en l\u00ednea Tutor LMS para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante al verificar firmas de webhook en la funci\u00f3n 'verifyAndCreateOrderData' en todas las versiones hasta la 3.8.3, inclusive. Esto permite a atacantes no autenticados eludir la verificaci\u00f3n de pagos y marcar pedidos como pagados al enviar solicitudes de webhook falsificadas con 'payment_type' establecido en 'recurring'."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:themeum:tutor_lms:*:*:*:*:free:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "D66EBFF5-F51F-4A4E-85F5-321FAB6AD260", "versionEndExcluding": "3.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}