The Tutor LMS – eLearning and online course solution plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the get_order_by_id() function in all versions up to 3.9.3. This flaw allows authenticated users with low-level privileges (Subscriber and above) to enumerate order IDs and retrieve sensitive personally identifiable information (PII) including student names, email addresses, phone numbers, and billing addresses. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low complexity and requiring low privileges, resulting in high confidentiality impact but no integrity or availability impact. No known exploits are reported in the wild, and no patch or official fix has been documented.

An attacker with at least Subscriber-level access can exploit this vulnerability to access sensitive personal data of students, including names, emails, phone numbers, and billing addresses. This exposure of PII can lead to privacy violations and potential misuse of personal data. The vulnerability does not affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity involving order data access. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the vendor for a security patch or official mitigation.