The Tutor LMS plugin for WordPress up to version 3.9.7 contains a missing authorization vulnerability (CWE-862) in its enrollment functions (`enroll_now()` and `course_enrollment()`). While these endpoints verify nonce, user authentication, and course purchasability, they do not check if the course is marked as private (`post_status`). As a result, authenticated users with Subscriber-level privileges can send crafted POST requests to enroll in private courses, causing enrollment records to be created and private course titles to be visible on their dashboard. Despite this, WordPress core permissions prevent these users from accessing the private course content itself, returning a 404 error if attempted.

An authenticated user with at least Subscriber-level access can enroll in private courses without having the required `read_private_posts` capability. This leads to unauthorized exposure of private course titles and enrollment status in the user's dashboard. However, the actual private course content remains protected by WordPress core access controls and is not accessible to these unauthorized users. There is no indication of denial of service or code execution impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting enrollment capabilities to trusted user roles and monitor for unusual enrollment activity. Since the vulnerability requires authenticated access, limiting user registrations and applying strict role assignments may reduce risk.