Tutor LMS WordPress Plugin Droip/Kirki Integration Unauthorized Course Enrollment Vulnerability

A vulnerability exists in the Tutor LMS WordPress plugin in versions prior to 3.9.13, specifically within the Droip and Kirki page-builder integrations. The plugin fails to apply the necessary checks for enrollment, purchase, and private-course capabilities that are enforced in its main course management system. As a result, authenticated users with subscriber-level access can unauthorizedly enroll in paid or private courses, access private course materials, and mark any course as completed, but only on sites where the Droip or Kirki integration is active.

Impact

Exploitation of this vulnerability allows for unauthorized enrollment in paid or private courses, access to private course content, and the ability to mark courses as completed.

Remediation

Users are advised to update the Tutor LMS WordPress plugin to version 3.9.13 or later.