The Tutor LMS Pro plugin for WordPress suffers from an insecure direct object reference that allows authenticated users with a Subscriber role or higher to view and edit the assignment submissions of other students. This flaw stems from missing validation on a user‑controlled key within the tutor_assignment_submit() function, thereby exposing confidential student work and enabling tampering with another user’s data. The vulnerability could be used to exfiltrate or alter sensitive coursework, compromising confidentiality and integrity of academic content.

WordPress sites using the themeum Tutor LMS Pro plugin with versions up to and including 3.8.3 are affected. Any site running these legacy versions that allows Subscriber users to submit assignments is vulnerable; the issue is tied directly to the assignment submission handling within the plugin.

The CVSS score of 5.4 indicates a medium impact, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. An attacker must first authenticate as a Subscriber or higher to exploit the vulnerability, typically through a browser session to the assignment submission endpoint. Because the weak credential validation occurs on the server side, the attack requires only normal web access and does not rely on privileged network exploitation.