CVE-2025-13934: CWE-862 Missing Authorization in themeum Tutor LMS – eLearning and online course solution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
AI Analysis
Technical Summary
CVE-2025-13934 is a missing authorization vulnerability (CWE-862) in the Tutor LMS WordPress plugin, versions up to 3.9.3. The vulnerability arises because the AJAX handler responsible for course enrollment lacks proper capability checks and validation of whether a course is purchasable. As a result, authenticated users with subscriber-level privileges can bypass the purchase process and enroll in any course without payment or proper authorization.
Potential Impact
An attacker with subscriber-level access or higher can enroll in any course without paying or having the required permissions. This leads to unauthorized access to course content, potentially causing financial loss to course providers and undermining the integrity of the LMS platform. There is no impact on confidentiality or availability reported, only integrity of enrollment controls is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting subscriber-level access or disabling the vulnerable enrollment functionality if possible. Monitor official channels from the vendor themeum for updates and apply patches promptly once available.
CVE-2025-13934: CWE-862 Missing Authorization in themeum Tutor LMS – eLearning and online course solution
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-13934 is a missing authorization vulnerability (CWE-862) in the Tutor LMS WordPress plugin, versions up to 3.9.3. The vulnerability arises because the AJAX handler responsible for course enrollment lacks proper capability checks and validation of whether a course is purchasable. As a result, authenticated users with subscriber-level privileges can bypass the purchase process and enroll in any course without payment or proper authorization.
Potential Impact
An attacker with subscriber-level access or higher can enroll in any course without paying or having the required permissions. This leads to unauthorized access to course content, potentially causing financial loss to course providers and undermining the integrity of the LMS platform. There is no impact on confidentiality or availability reported, only integrity of enrollment controls is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting subscriber-level access or disabling the vulnerable enrollment functionality if possible. Monitor official channels from the vendor themeum for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-02T22:22:20.669Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6960b130ecefc3cd7c0f7cfb
Added to database: 1/9/2026, 7:41:36 AM
Last enriched: 4/9/2026, 4:39:35 PM
Last updated: 5/8/2026, 12:08:47 PM
Views: 102
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.