This vulnerability in Themeum Tutor LMS Pro allows an attacker to bypass authentication by exploiting an alternate path or channel within the application. Affected versions include all releases up to and including 3.9.4. The CVSS 3.1 base score of 8.1 reflects network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to bypass authentication controls, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized access to sensitive data and administrative functions within Tutor LMS Pro.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Themeum's communications for updates and consider implementing additional access controls or network-level restrictions to limit exposure.