The Tutor LMS Pro plugin contains a flaw that allows an attacker to bypass normal authentication, gaining unauthorized access to protected areas of the WordPress site. This weakness, classified as CWE-288, enables the compromise of course content, student data, and administrative settings.

All installations of the Themeum Tutor LMS Pro plugin for WordPress with a version of 3.9.4 or earlier are affected. Site owners should immediately check the plugin version in the WordPress admin area and determine whether the installation is at risk.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests the likelihood of widespread exploitation is currently low. It is inferred that an attacker could exploit the vulnerability by sending a specially crafted request to an alternate URL or API endpoint that bypasses the plugin’s authentication checks. Successful exploitation would give the attacker full control over the plugin’s protected functions, potentially leading to data loss, content manipulation, or further compromise of the entire WordPress site. The vulnerability is not listed in the CISA KEV catalog.