ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3360

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7.

Published Apr 10, 2026 · updated Jun 17, 2026

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the function. The function accepts an attacker-controlled parameter and uses it to look up order data, then writes billing fields to the order owner's profile ( ) without verifying the requester's identity or ownership. Because the Tutor nonce ( ) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated .

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2026 · NIST NVD

    Detected

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the function. The function accepts an attacker-controlled parameter and uses it to look up order data, then writes billing fields to the order owner's profile ( )

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the function. The function accepts an attacker-controlled parameter and uses it to look up order data, then writes billing fields to the order owner's profile ( )

Sources

  • CVE.orgVulnerability recordCVE-2026-3360

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3360

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the function. The

    nvd.nist.gov

References