Missing authorization in the Tutor LMS plugin for WordPress allows an attacker to bypass intended access restrictions and read or modify data that should be protected. This flaw arises from incorrectly configured access control security levels, enabling users with insufficient privileges to perform privileged actions. The weakness is classified as CWE‑862, a missing authorization issue.

The vulnerability affects the Themeum Tutor LMS plugin for WordPress, versions up to and including 3.9.7. Any installation running these versions is susceptible; newer releases are not impacted.

The CVSS score is not publicly available, and EPSS data is lacking, so a precise risk level cannot be quantified. The plugin operates in a web environment, so the likely attack vector is remote, accessed via HTTP requests to the WordPress site. An attacker who can log in with a limited role or trick a user into visiting specific URLs may exploit the broken access control to obtain unauthorized data or perform administrative actions.