5.4
Medium
CVE-2025-6639 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…
Description
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tutor LMS Pro 3.8 | earliest → 3.8.3 | No fix stated |
Other CVEs of Tutor LMS Pro
The 9 CVEs of Tutor LMS Pro →
CVE-2026-22332
Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions
9.3
Critical
CVE-2026-25406
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows…
8.1
High
CVE-2026-0953
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
9.8
Critical
CVE-2025-6184
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL…
8.8
High