The Tutor LMS plugin for WordPress has a missing capability check on the delete_existing_user_photo function. As a result, any authenticated user with subscriber-level access and above can invoke the function to delete arbitrary attachments stored on the site. This flaw is a classic example of a missing authorization flaw, classified as CWE‑862, and can lead to loss of course materials, user uploads, and other critical media files, thereby affecting data integrity and availability.

This vulnerability affects the Tutor LMS – eLearning and online course solution plugin for WordPress, versions 3.9.4 and earlier. Users running these plugin versions are exposed to the risk of unauthorized attachment deletion.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The flaw requires only that the attacker be a legitimate authenticated user with subscriber-level or higher role, with no external dependencies. The vulnerability is not listed in CISA’s KEV catalog. Consequently, the risk is moderate but the likelihood of exploitation is low; however, because any authenticated user could delete any attachment, the potential impact on site content integrity remains significant.