The vulnerability is an Authorization Bypass through a User‑Controlled Key that allows attackers to manipulate object identifiers and access Tutor LMS resources without proper authorization. This Insecure Direct Object Reference flaw can enable reading, editing, or deleting course and student data, thereby compromising confidentiality and integrity. The weakness is classified as CWE-639.

The affected product is Themeum’s Tutor LMS WordPress plugin for all WordPress sites running a version up to and including 3.9.4. Hosts that have not yet upgraded beyond this release are exposed.

The EPSS score indicates a probability of exploitation below 1%, and the issue is not listed in CISA’s KEV catalog, suggesting a lower exploit prevalence. However, the attack vector likely involves crafting HTTP requests to the plugin’s endpoints using modified parameters or keys, a path that can be accessed by authenticated users or potentially by unauthenticated users depending on the site setup. The severity is moderate with a CVSS score of 6.5, but the risk remains significant for sites that rely on the plugin for sensitive educational data.