The Tutor LMS plugin for WordPress suffers from an insecure direct object reference in its init_routes function, which fails to validate a user‑controlled key before granting access to REST API endpoints. This flaw allows authenticated users with subscriber‑level access or higher to retrieve protected content such as paid course lessons and topics, quiz answer keys—including the is_correct field—before attempting a quiz, and to enumerate the email addresses, usernames, and registration data of other users, including instructors and administrators. The weakness is a classic example of CWE‑639, where an attacker bypasses intended access controls through manipulation of a user‑controlled key.

WordPress sites that have the Tutor LMS – eLearning and online course solution plugin (themeum) installed with a version of 4.1.2 or earlier are affected. Any site using these versions with the plugin’s API key management feature exposes authenticated subscribers to the data leakage described above.

The CVSS score of 6.5 places this vulnerability in the medium severity range. Exploitation requires the attacker to possess a valid Tutor LMS API key/secret pair, which is normally issued to subscriber-level users through the plugin’s API key management feature; thus the attack vector is authenticated access to the REST API. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that while the flaw is publicly known, widespread exploitation has not been documented. Nevertheless, the ability to uncover confidential course material and personal user data represents a notable confidentiality risk that warrants timely remediation.