CVE-2025-6639
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Tutor LMS Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.8.3 due to missing validation on a user-controlled key in the tutor_assignment_submit() function. An authenticated attacker with Subscriber-level access or above can view and edit assignment submissions of other students.
Risk Assessment
Breach of data confidentiality and integrity — students can access and modify other users' submissions.
Recommendation
Update the Tutor LMS Pro plugin to a version newer than 3.8.3 and enforce server-side authorization checks for assignment submission operations.
Other vulnerabilities in Tutor LMS Pro
Original NVD description (English source)
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS