Tutor LMS Missing Authorization Vulnerability Allows Unauthorized Course Completion

A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions up to and including 3.9.2. The issue arises from a lack of proper enrollment verification in the 'mark_course_complete' function. This flaw enables authenticated users with subscriber-level access or higher to mark any course as completed, bypassing the intended enrollment requirements.

Impact

Exploitation of this vulnerability allows for arbitrary course completion, potentially leading to unauthorized access to course materials or certifications.

Remediation

Users are advised to update the Tutor LMS plugin to version 3.9.4 or a newer patched version.