Medium severity · published Oct 25, 2025
CVE-2025-11564
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function
in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TL
Tutor LMS – eLearning and online course solution · themeum
through 3.8.3 · source: vendor
TL
Tutor Lms · Themeum
before 3.9.0 · source: NVD
Affected product
TL
Tutor LMS – eLearning and online course solution
themeum
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11564
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11564
Product
https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve
More from Tutor LMS – eLearning and online course solution
8.8
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
8.1
CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
7.5
CVE-2026-3360
Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
7.5
CVE-2025-13673
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
6.5
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter