Tutor LMS vulnerabilities

A race condition vulnerability in Tutor LMS by Themeum allows leveraging race conditions. Affects versions from n/a through 4.1.1.

The Tutor LMS plugin for WordPress up to version 4.0.1 is vulnerable to generic SQL Injection via the 'coupon_code' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

The Tutor LMS plugin for WordPress in versions up to and including 4.0.7 is vulnerable to Insecure Direct Object Reference via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values belong to a quiz/topic/course the requester is authorized to manage. An authenticated attacker with Instructor-level access or higher can overwrite content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and delete arbitrary quiz question and answer rows.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'student_id' parameter. Missing validation on a user-controlled key allows authenticated attackers with subscriber-level access and above to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access and above to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires triggering the profile-photo upload flow, creating a Tutor topic reparented to that attachment, then invoking the lesson deletion handler against any target post ID.

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content. This allows any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential. This allows the holder of a read-only key to act as the administrator account that issued it.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.7) is vulnerable to PHP Object Injection via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. The handler lacks capability or role checks, relying solely on a nonce, and passes attacker-supplied values through `esc_sql()`, causing serialized string length mismatches that allow injection of an arbitrary serialized object stream. An authenticated attacker with subscriber-level access or above can achieve remote code execution via the `GuzzleHttp\Cookie\FileCookieJar` POP chain, with an unauthenticated pathway when user registration is enabled.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. Missing authorization combined with unsanitized array keys passed to extract() inside tutor_load_template() allow attacker-controlled POST data to overwrite local variables and invoke arbitrary zero-argument PHP functions.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate values used to build a database query and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and read question and answer content from courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can read arbitrary files on the server, including files outside the web root. Readable files include the WordPress configuration file, exposing database credentials and authentication keys and salts, allowing authentication cookies to be forged.

The Tutor LMS WordPress plugin before version 4.0.6 does not enforce per-object ownership checks on its course content type. This allows any user with the instructor role to read the content of private courses belonging to other instructors.

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content. This allows authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

The Tutor LMS plugin for WordPress up to version 4.0.0 inclusive contains a second-order SQL injection vulnerability. An authenticated attacker with custom-level access or higher can store a malicious SQL query in a quiz answer, which executes when a privileged user or REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint.

The Tutor LMS plugin for WordPress contains an authorization bypass vulnerability through a user-controlled key. This flaw allows exploiting incorrectly configured access control security levels.

The Tutor LMS WordPress plugin before version 3.9.13 fails to enforce enrollment, purchase, and private-course capability checks in its Droip and Kirki page-builder integration. This allows authenticated users with subscriber-level access to enroll in paid or private courses, read private course content, and mark arbitrary courses as completed.

The Tutor LMS WordPress plugin before version 3.9.13 fails to verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier. This allows authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

The Tutor LMS WordPress plugin before version 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved. This allows authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

The Tutor LMS WordPress plugin before version 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

The Tutor LMS plugin for WordPress up to version 3.9.13 inclusive is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title due to insufficient input sanitization and output escaping.

Versions of Tutor LMS up to 3.9.7 have an issue with unauthenticated access that can lead to broken access control.

The Tutor LMS plugin for WordPress in versions up to and including 3.8.3 is vulnerable to Sensitive Information Exposure. An authenticated attacker with tutor-level access or above can view assignments for courses they do not teach, which may contain sensitive information.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.