Tutor LMS Missing Capability Check Vulnerability in Webhook Payment Verification

A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions through 3.8.3. The issue arises from a lack of proper capability checks in the 'verifyAndCreateOrderData' function, which handles webhook signature verification. This flaw allows unauthenticated attackers to bypass payment verification processes and falsely mark orders as paid by sending fake webhook requests with the 'payment_type' designated as 'recurring'.

Impact

Exploitation of this vulnerability allows for unauthorized modification of order payment statuses, potentially leading to financial discrepancies or fraud.

Remediation

Users are advised to update the Tutor LMS plugin to version 3.9.0 or a newer patched version.