Tutor LMS Missing Authorization Vulnerability Allows Unauthorized Course Enrollment

A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions up to and including 3.9.3, allowing unauthorized course enrollment. This issue arises from a lack of proper capability checks and validation of course purchasability in the 'course_enrollment()' AJAX handler. As a result, authenticated users with subscriber-level access or higher can enroll themselves in any course without completing the required purchase process.

Impact

Exploitation of this vulnerability allows authenticated users with subscriber-level access and above to enroll in courses without payment, bypassing the intended purchase process.

Remediation

Users are advised to update the Tutor LMS plugin to version 3.9.4 or a later patched version.