The Tutor LMS plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability (CWE-862) due to missing authentication and authorization in the pay_incomplete_order() function. This function accepts an attacker-controlled order_id parameter and updates billing fields on the order owner's profile without verifying the requester's identity or ownership. The presence of the Tutor nonce (_tutor_nonce) on public frontend pages enables unauthenticated attackers to craft POST requests with guessed or enumerated order_id values to overwrite billing information such as name, email, phone, and address of any user who has an incomplete manual order.

This vulnerability allows unauthenticated attackers to modify billing profile data of other users who have incomplete manual orders. While it does not disclose sensitive data or affect confidentiality directly, it compromises data integrity by enabling unauthorized modification of user billing information. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting access to incomplete order processing endpoints or disabling manual order functionality may reduce exposure. Avoid exposing the Tutor nonce on public pages if possible.