CVE-2025-13628: 
WordPress vulnerability analysis and mitigation

CVE-2025-13628 is a Missing Authorization vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress, developed by Themeum. The flaw allows authenticated attackers with subscriber-level access or above to perform unauthorized modification and deletion of coupon data. All versions up to and including 3.9.3 are affected. It was disclosed on January 9, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of proper capability checks on two functions: bulk_action_handler and coupon_permanent_delete within the plugin's CouponController.php file. Any authenticated user with at minimum subscriber-level access can invoke these functions via network requests, bypassing the intended access controls. The fix was applied in the plugin's source code as visible in the WordPress plugin repository changeset (WordPress Changeset, Wordfence).

Successful exploitation allows authenticated low-privileged users to delete, activate, deactivate, or trash arbitrary coupons within the Tutor LMS plugin, directly impacting the integrity of the e-commerce and course enrollment system. There is no confidentiality or availability impact, but the ability to manipulate or destroy coupon data could disrupt promotional campaigns, cause financial loss, or undermine trust in the platform's e-commerce functionality. The scope is limited to the affected WordPress installation and does not enable lateral movement or code execution (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-13628. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability requires authentication (subscriber-level or above), which limits the attacker pool but does not eliminate risk on sites with open registration. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running Tutor LMS plugin version 3.9.3 or earlier with user registration enabled, allowing the attacker to create or use a subscriber-level account.
2. Authentication: Log in to the target WordPress site with a valid subscriber-level (or higher) account.
3. Identify target coupons: Browse or enumerate available coupon IDs within the Tutor LMS e-commerce system (e.g., via the plugin's frontend or by observing network requests).
4. Craft malicious request: Send a crafted HTTP POST request directly to the bulk_action_handler or coupon_permanent_delete function endpoints, supplying target coupon IDs and the desired action (delete, activate, deactivate, or trash) without possessing the required administrative capability.
5. Achieve unauthorized modification: Due to the missing capability check, the server processes the request and performs the specified action on the targeted coupons, bypassing authorization controls (Wordfence, WordPress Changeset).

• Logs: WordPress access logs showing authenticated POST requests to Tutor LMS coupon management endpoints (e.g., admin-ajax.php or REST API routes related to bulk_action_handler or coupon_permanent_delete) from low-privileged user accounts.
• Application: Unexpected changes to coupon status (deletion, activation, deactivation, or trashing) in the Tutor LMS dashboard not attributable to administrator actions.
• Logs: WordPress audit logs (if enabled) recording coupon modification or deletion events initiated by subscriber-level users.

Users should update the Tutor LMS plugin to version 3.9.4 or later, which includes the fix adding proper capability checks to the bulk_action_handler and coupon_permanent_delete functions. The patch is available via the WordPress plugin repository. As an interim measure, site administrators can disable user registration or restrict subscriber-level access until the update is applied (WordPress Changeset, Wordfence).

Sucuri included CVE-2025-13628 in their January 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). Wordfence, as the CVE assigning authority, published the initial advisory and threat intelligence entry. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.