CVE-2025-13679: 
WordPress vulnerability analysis and mitigation

CVE-2025-13679 is a missing authorization vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress, developed by Themeum. It affects all versions up to and including 3.9.3, and was published on January 8, 2026, with the fix released in version 3.9.4. The flaw allows authenticated attackers with Subscriber-level access or above to enumerate order IDs and exfiltrate sensitive personally identifiable information (PII). It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Wordfence (Wordfence).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of a capability check on the get_order_by_id() function within the plugin's ecommerce/OrderController.php file. Because no authorization gate is enforced before returning order data, any authenticated user — including those with the lowest default WordPress role (Subscriber) — can supply arbitrary order IDs and retrieve the associated records. The attack is network-based, requires low privileges, no user interaction, and low complexity, making it straightforward to exploit once an attacker has any valid WordPress account (Wordfence, WordPress Changeset).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. Attackers can enumerate all order IDs and extract PII for every student who has placed an order, including full name, email address, phone number, and billing address. On platforms with large student enrollments, this could expose the personal data of thousands of users, creating significant privacy and regulatory compliance risks (e.g., GDPR, CCPA) (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.034%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low barrier to exploitation — requiring only a valid Subscriber-level WordPress account — means the risk escalates significantly on sites with open registration (Wordfence).

1. Obtain a Subscriber account: Register for a free account on the target WordPress site running Tutor LMS ≤ 3.9.3, or use any existing low-privilege credentials.
2. Authenticate: Log in to the WordPress site to obtain a valid session cookie or application password.
3. Identify the vulnerable endpoint: Locate the REST API or AJAX endpoint that invokes get_order_by_id() within the Tutor LMS plugin's OrderController.php.
4. Enumerate order IDs: Send sequential or randomized authenticated HTTP requests to the endpoint with incrementing order ID values (e.g., ?order_id=1, ?order_id=2, etc.).
5. Exfiltrate PII: Parse the JSON responses to collect student names, email addresses, phone numbers, and billing addresses for each valid order ID returned (Wordfence).

• Network: Repeated authenticated HTTP requests to the Tutor LMS order lookup endpoint with sequentially or randomly incrementing order_id parameters from a single IP or user account in a short time window.
• Logs: WordPress access logs showing a high volume of requests to the OrderController endpoint (e.g., /wp-admin/admin-ajax.php or REST API path) by a Subscriber-level user; unusual access patterns outside normal business hours.
• Application: A single low-privilege user account querying a large number of distinct order IDs in rapid succession, which would be anomalous compared to normal student behavior.

The vendor Themeum released version 3.9.4 of the Tutor LMS plugin, which adds the missing capability check to the get_order_by_id() function. Site administrators should update the plugin to version 3.9.4 or later immediately via the WordPress plugin dashboard. As a temporary workaround prior to patching, administrators can disable open user registration to prevent untrusted parties from obtaining Subscriber-level accounts, though this does not eliminate risk from existing low-privilege users (WordPress Changeset, Wordfence).

Wordfence disclosed and reported the vulnerability, assigning the CVSS score and CWE classification. The vulnerability was included in Wordfence's weekly WordPress vulnerability report for January 5–11, 2026, and was also covered in Sucuri's January 2026 vulnerability patch roundup (Wordfence Weekly Report, Sucuri Roundup). No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been observed.