The Tutor LMS plugin is vulnerable in all versions up to and including 3.9.3 because the course_enrollment AJAX handler lacks a capability check and purchase validation. Authenticated users with subscriber-level access can invoke this handler to enroll themselves in any course, bypassing the normal payment flow. This allows unauthorized access to paid course content and can lead to revenue loss for site administrators.

WordPress sites that have installed the Tutor LMS – eLearning and online course solution plugin with a version no newer than 3.9.3 are affected. Any site that has not upgraded beyond that version is at risk.

The CVSS score of 4.3 indicates moderate severity while the EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers who are authenticated with subscriber or higher privileges can exploit the flaw by sending a crafted AJAX request to the course_enrollment endpoint, thereby enrolling themselves in any course without payment. The impact is primarily financial and integrity-based, as course access is granted without following the proper purchase authorization.