The Tutor LMS plugin for WordPress contains a flaw that permits any authenticated user with Subscriber or higher role to enroll in courses marked as private. The enroll_now() and course_enrollment() functions validate the nonce, authentication, and whether the course is purchasable, but omit a check for the course’s private post_status. Consequently, a crafted POST request with the target course ID creates an enrollment record in the database, and the subscriber can view the private course title and enrollment status in their dashboard. Although WordPress core blocks access to the actual content, the exposed metadata reveals private course existence, leading to privacy leakage.

All WordPress sites that use the Tutor LMS plugin version 3.9.7 or earlier are affected. The plugin is distributed by themeum and is commonly installed on eLearning WordPress sites. Sites that have not upgraded beyond 3.9.7 retain the vulnerability and may unintentionally allow subscriber‑level users to enroll in private courses.

The CVSS score of 5.4 indicates medium severity. Any authenticated user can exploit the flaw by sending a simple POST request to the enrollment endpoint, requiring only basic knowledge of HTTP methods and the target course ID. No elevated privileges or complex exploits are necessary. The absence of an EPSS score and the lack of inclusion in the CISA KEV catalog suggest that exploitation is not yet widespread, but the easy accessibility of the vulnerability demands prompt remediation.