The Tutor LMS plugin for WordPress suffers from a missing capability check during webhook signature verification in the verifyAndCreateOrderData function. This flaw allows unauthenticated attackers to forge webhook requests with the payment_type parameter set to 'recurring', bypassing payment verification and marking orders as paid. The vulnerability affects all versions up to and including 3.8.3. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch link provided, and the product is not a cloud service.

An attacker can modify order data without authorization by bypassing payment verification, potentially allowing fraudulent marking of orders as paid. This impacts the integrity of order data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to webhook endpoints or implementing additional verification controls to validate webhook requests. Monitor for updates from the vendor Themeum regarding patches or official mitigations.