The Tutor LMS plugin for WordPress suffers from a missing authorization check (CWE-862) in its enroll_now() and course_enrollment() functions. While these endpoints verify nonce, user authentication, and course purchasability, they fail to check if the course post_status is 'private'. This allows authenticated users with Subscriber-level privileges or higher to enroll in private courses by sending crafted POST requests with the target course ID. Enrollment records are created and private course titles and enrollment status become visible in the subscriber's dashboard, though actual course content remains inaccessible due to WordPress core permissions. The vulnerability affects all versions up to 3.9.7 and has a CVSS 3.1 base score of 5.4 (medium severity). No vendor patch or official remediation is currently documented.

Authenticated users with Subscriber-level access or above can enroll in private courses without proper authorization, resulting in unauthorized enrollment records and exposure of private course titles and enrollment status in their dashboard. However, they cannot access the private course content itself due to WordPress core access controls returning 404 errors. There is no indication of denial of service or data modification beyond enrollment records. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting Subscriber-level access or monitoring enrollment activity for anomalies. Since the vulnerability involves missing authorization checks in the plugin, upgrading to a patched version when released is recommended. No official patch or temporary fix is currently documented.