The Tutor LMS plugin contains a missing authorization check in the ajax_coupon_details() function, which only validates nonces but does not verify user capabilities. The result is a sensitive information exposure (CWE‑200) that allows authenticated users with Subscriber level or higher access to view coupon codes, discount amounts, usage statistics, and the courses or bundles to which a coupon applies. An attacker with legitimate login credentials can therefore obtain confidential coupon data and potentially abuse or share it.

WordPress installations that use the Tutor LMS – eLearning and online course solution plugin from Themeum, versions up to and including 3.9.5, are affected.

The vulnerability is scored CVSS 5.3, indicating moderate severity. The EPSS score is listed as less than 1%, implying a very low likelihood of exploitation at present, and the issue is not in the CISA KEV catalog. The lack of role checks means the attack requires authentication but can be carried out by any Subscriber or higher role user, making the attack vector an authenticated internal request rather than a remote unauthenticated attack.