CVE-2025-13679 — Tutor LMS – eLearning and online course solution [tutor] < 3.9.4

CVE-2025-13679

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org