The vulnerability arises from a missing capability check in the Tutor LMS plugin’s get_order_by_id() function. With any authenticated user who has a Subscriber role or higher, an attacker can enumerate order identifiers and retrieve personally identifiable information, including names, email addresses, phone numbers, and billing addresses. This directly leads to the unauthorized disclosure of sensitive user data. The weakness corresponds to the CWE-862 "Missing Authorization Check."

The flaw exists in the Tutor LMS – eLearning and online course solution plugin for WordPress, affecting all installations of version 3.9.3 and earlier. Any WordPress site that has installed this plugin and provides Subscriber-level access is vulnerable.

The overall CVSS score of 6.5 indicates a moderate severity. The EPSS score is less than 1%, implying low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the attacker possesses a valid account with Subscriber or higher role; no elevated privileges or additional conditions are necessary. Once authenticated, the attacker can enumerate and exfiltrate PII from order records.