CVE-2026-3360 Details
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions up to and including 3.9.7. The issue is an Insecure Direct Object Reference (IDOR) that arises from inadequate authentication and authorization checks in the 'pay_incomplete_order()' function. This function allows unauthenticated users to manipulate the 'order_id' parameter to access and modify order data. As a result, attackers can overwrite the billing information (including name, email, phone, and address) of any user with an incomplete manual order by sending a crafted POST request with a guessed or enumerated 'order_id'. The vulnerability is exacerbated by the exposure of the Tutor nonce on public frontend pages, allowing for unauthorized modifications to user profiles.
Users are advised to update the Tutor LMS plugin to version 3.9.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 10, 2026CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tutor LMS | <= 3.9.7 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |