Tutor LMS, a WordPress eLearning plugin, contains an insecure direct object reference that allows an attacker to send an unverified POST request to the pay_incomplete_order() function. By supplying a crafted order_id parameter, the function retrieves the order record and writes billing details (name, email, phone, address) to the order owner's profile without any authentication or authorization checks. The weakness is categorized as CWE‑862, enabling unauthorized data modification.

All versions of the Tutor LMS plugin for WordPress up to and including 3.9.7 are affected. This includes installations that have incomplete manual orders and expose the Tutor nonce on public pages.

The vulnerability scores a 7.5 on the CVSS scale, indicating high severity. Exploitability is high because the attack requires only a crafted HTTP request and does not depend on user interaction or elevated privileges. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. An unauthenticated attacker can therefore obtain control over the billing profile of any user who has an incomplete manual order, potentially leading to phishing or fraud attempts.