The vulnerability lies in the absence of enrollment verification within the mark_course_complete routine of the Tutor LMS plugin. This flaw is a CWE-862 (Missing Authorization) weakness that allows authenticated users with at least subscriber privileges to mark any course as finished, regardless of whether they are actually enrolled. The consequence is that enrolled students may see false progress, instructors cannot rely on completion data, and grading or certification processes that depend on completion status may be compromised.

WordPress installations running the Tutor LMS eLearning plugin up to and including version 3.9.2 are impacted. Version 3.9.3 and later include the fix.

The CVSS score of 4.3 reflects a low to moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to be either a normal subscriber or higher, which most sites will allow. Once authenticated, the attacker can submit a request that triggers the missing authorization check, causing the specified course to be marked complete with no additional requirements.