The Tutor LMS – Migration Tool plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the tutor_import_from_xml function in all versions up to and including 2.2.0. This flaw allows any authenticated user with at least subscriber privileges to import courses, bypassing intended capability checks. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no user interaction required, but limited impact confined to integrity modification without confidentiality or availability effects.

An attacker with subscriber-level access or higher can exploit this vulnerability to import courses into the LMS, resulting in unauthorized modification of course data. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to course imports. Avoid granting unnecessary permissions to low-privilege users.