The vulnerability lies in the absence of a capability check in the bulk_action_handler and coupon_permanent_delete functions of the Tutor LMS plugin. As a result, any authenticated user with subscriber level access or higher can delete, activate, deactivate, or trash arbitrary coupons. This represents a missing access control flaw (CWE‑862) that allows unauthorized modification of coupon data, potentially disrupting pricing structures and revenue streams.

All installations of the Tutor LMS – eLearning and online course solution plugin from themeum that are running version 3.9.3 or earlier. The plugin is a WordPress extension and any site that includes it is vulnerable until an update is applied.

The CVSS score of 4.3 indicates moderate risk, but the EPSS score of less than 1% shows that the exploitation probability is currently very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated with at least subscriber level access, meaning that anyone holding such an account on a vulnerable site could exploit the flaw. Because the flaw only allows coupon manipulation and does not grant code execution or privilege escalation, the impact is limited to the integrity of coupon data.