CVE-2026-3360: CWE-862 Missing Authorization in themeum Tutor LMS – eLearning and online course solution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
AI Analysis
Technical Summary
CVE-2026-3360 is an authorization bypass vulnerability (CWE-862) in the Tutor LMS WordPress plugin (up to version 3.9.7). The pay_incomplete_order() function accepts an attacker-controlled order_id parameter and updates billing fields in the order owner's profile without verifying the requester's identity or ownership. The presence of a publicly exposed Tutor nonce (_tutor_nonce) on frontend pages enables unauthenticated attackers to send crafted POST requests with guessed or enumerated order_id values to overwrite billing information such as name, email, phone, and address of users who have incomplete manual orders.
Potential Impact
This vulnerability allows unauthenticated attackers to modify billing profile data of any user with an incomplete manual order, impacting data integrity. There is no direct confidentiality or availability impact reported. The CVSS 3.1 base score is 7.5 (High), reflecting the ease of remote exploitation without privileges or user interaction and the significant integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to incomplete order functionality and monitor for suspicious POST requests targeting order_id parameters. Avoid exposing the Tutor nonce on public frontend pages if possible. Follow vendor updates closely for an official fix.
CVE-2026-3360: CWE-862 Missing Authorization in themeum Tutor LMS – eLearning and online course solution
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3360 is an authorization bypass vulnerability (CWE-862) in the Tutor LMS WordPress plugin (up to version 3.9.7). The pay_incomplete_order() function accepts an attacker-controlled order_id parameter and updates billing fields in the order owner's profile without verifying the requester's identity or ownership. The presence of a publicly exposed Tutor nonce (_tutor_nonce) on frontend pages enables unauthenticated attackers to send crafted POST requests with guessed or enumerated order_id values to overwrite billing information such as name, email, phone, and address of users who have incomplete manual orders.
Potential Impact
This vulnerability allows unauthenticated attackers to modify billing profile data of any user with an incomplete manual order, impacting data integrity. There is no direct confidentiality or availability impact reported. The CVSS 3.1 base score is 7.5 (High), reflecting the ease of remote exploitation without privileges or user interaction and the significant integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to incomplete order functionality and monitor for suspicious POST requests targeting order_id parameters. Avoid exposing the Tutor nonce on public frontend pages if possible. Follow vendor updates closely for an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-02-27T19:38:55.529Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d857791cc7ad14da4a0d47
Added to database: 4/10/2026, 1:50:49 AM
Last enriched: 4/17/2026, 12:20:27 PM
Last updated: 5/25/2026, 12:20:03 PM
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.