The Tutor LMS plugin for WordPress contains a missing capability check during webhook signature verification. This flaw allows an unauthenticated user to forge a payment webhook request with the field payment_type set to 'recurring', causing the plugin to mark the order as paid without validating the caller. The attacker can thus create false payment records, potentially gaining access to paid content and generating fraudulent revenue entries.

The vulnerability affects the Tutor LMS – eLearning and online course solution plugin published by themeum. All releases up to and including version 3.8.3 are susceptible. No version information beyond this range is provided, so any installation of 3.8.3 or earlier is considered at risk.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of real‑world exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the payment gateway webhook endpoint, with a forged payload that bypasses signature validation. Because no authentication is required, an attacker with internet access could submit the malicious request directly to the vulnerable site.