The Tutor LMS Pro plugin for WordPress suffers from an improper authorization vulnerability (CWE-285) identified as CVE-2025-6639. The issue arises from insufficient validation of a user-controlled key parameter in the tutor_assignment_submit() function, which handles viewing and editing of assignment submissions. This allows authenticated users with low privileges (Subscriber-level and above) to access and modify assignment submissions belonging to other students. The vulnerability affects all versions up to and including 3.8.3. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact. There is no indication of known exploits in the wild or an available patch at this time.

An attacker with authenticated Subscriber-level access or higher can view and modify assignment submissions of other students, potentially leading to unauthorized disclosure and alteration of academic data. The impact affects confidentiality and integrity but does not affect availability. This could undermine trust in the LMS platform's data integrity and privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to assignment submissions. Avoid granting unnecessary permissions to users. Follow updates from the vendor for an official patch or mitigation.