CVE-2025-13934: 
WordPress vulnerability analysis and mitigation

CVE-2025-13934 is a Missing Authorization vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress, allowing authenticated attackers to enroll in any course without payment. It affects all versions up to and including 3.9.3, developed by Themeum. The vulnerability was disclosed on January 9, 2026, with a fix available in version 3.9.4. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence, NVD).

The root cause is a missing capability check and purchasability validation in the course_enrollment() AJAX handler within classes/Course.php (CWE-862: Missing Authorization). Any authenticated WordPress user with at least subscriber-level access can send a crafted AJAX request directly to this handler, bypassing the normal purchase flow entirely. No special privileges beyond a basic registered account are required, and the attack is conducted over the network with low complexity. The fix was applied in the plugin changeset 3422766 (Wordfence, Plugin Changeset).

Successful exploitation allows authenticated attackers to enroll themselves in any paid course on the affected WordPress site without completing a purchase, resulting in unauthorized access to premium course content. The primary impact is an integrity violation — the enrollment state is modified without authorization — and a financial loss for course creators whose paid content becomes freely accessible to any registered user. There is no direct confidentiality or availability impact, and the scope is limited to the affected WordPress installation (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low barrier to exploitation — requiring only a subscriber-level WordPress account — makes it a practical risk for sites with open user registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running Tutor LMS plugin version 3.9.3 or earlier. This can be done by checking the plugin version in the site's readme or via tools like WPScan.
2. Account Registration: Register a free subscriber-level account on the target WordPress site, or use an existing low-privilege account.
3. Identify Target Course: Browse the site to identify the ID of a paid course the attacker wishes to access without purchasing.
4. Craft AJAX Request: Send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter targeting the course_enrollment() handler and the target course ID, while authenticated as the subscriber user.
5. Gain Unauthorized Enrollment: The handler processes the enrollment request without verifying payment or user capability, enrolling the attacker in the paid course and granting access to its content (Wordfence, Plugin Changeset).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with Tutor LMS enrollment action parameters from subscriber-level accounts, particularly for courses that were not purchased.
• Database: Unexpected enrollment records in the Tutor LMS enrollment tables (e.g., wp_tutor_enrolled) for users who have no corresponding payment/order records in WooCommerce or other payment integrations.
• Application Behavior: Subscriber-level users appearing in course enrollment lists for paid courses without any associated transaction history.

Site administrators should update the Tutor LMS plugin to version 3.9.4 or later, which includes the fix for the missing capability check and purchasability validation in the course_enrollment() AJAX handler. As an interim measure, disabling open user registration on the WordPress site can reduce the attack surface by preventing unauthenticated users from obtaining subscriber accounts. Reviewing existing enrollment records for anomalies (enrollments without corresponding purchases) is also recommended to identify any prior unauthorized access (Plugin Changeset, Wordfence).

Sucuri included this vulnerability in their January 2026 vulnerability patch roundup, highlighting it as a notable WordPress plugin issue requiring prompt patching (Sucuri Blog). Wordfence, as the CVE assigning authority, published the initial advisory and threat intelligence entry. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.