Vulnerability Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Themeum | Tutor Lms | < 3.9.0 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGatProduct
- https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d0ProductThird Party Advisory
FAQ
What is CVE-2025-11564?
CVE-2025-11564 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the...
How severe is CVE-2025-11564?
CVE-2025-11564 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-11564?
Check the references section above for vendor advisories and patch information. Affected products include: Themeum Tutor Lms.