CVE-2025-32223: 
WordPress vulnerability analysis and mitigation

CVE-2025-32223 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the Themeum Tutor LMS WordPress plugin. It allows authenticated attackers with low privileges to bypass access controls by exploiting incorrectly configured security levels. The vulnerability affects Tutor LMS versions up to and including 3.9.4. It was published on March 19, 2026, with Patchstack credited as the assigner. The CVSS v3.1 base score is 6.5 (Medium) (ENISA EUVD, Red Hat CVE).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). An authenticated user with low privileges can manipulate user-controlled keys or identifiers in requests to access resources or data belonging to other users, bypassing the plugin's access control checks. The attack vector is network-based, requires no user interaction, and has low attack complexity, meaning exploitation is straightforward once an account is obtained. No public proof-of-concept code has been identified at this time (ENISA EUVD, Patchstack).

Successful exploitation results in a high confidentiality impact, allowing authenticated low-privileged users to access sensitive data belonging to other users or roles within the LMS platform, such as course content, student records, or private information. Integrity and availability are not directly affected by this vulnerability. In a WordPress LMS environment, this could expose personally identifiable information (PII) of students, instructor materials, or administrative data to unauthorized parties (ENISA EUVD).

No active in-the-wild exploitation has been reported for CVE-2025-32223, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. Exploitation requires a valid (low-privileged) account on the target WordPress site, limiting opportunistic mass exploitation (ENISA EUVD, Feedly).

1. Reconnaissance: Identify WordPress sites running the Tutor LMS plugin version 3.9.4 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Account Registration: Register or obtain a low-privileged account on the target site (e.g., as a student or subscriber).
3. Identify Object References: Interact with the LMS platform to identify user-controlled keys or object identifiers (e.g., course IDs, quiz IDs, user IDs) used in API requests or URL parameters.
4. Manipulate Identifiers: Modify the user-controlled key in requests (e.g., changing a numeric ID in a GET/POST parameter) to reference resources belonging to other users or higher-privileged roles.
5. Access Unauthorized Data: Observe the server response to retrieve sensitive data such as other users' course progress, quiz answers, personal information, or restricted content that should not be accessible to the attacker's role (ENISA EUVD, Patchstack).

• Logs: WordPress access logs showing repeated requests to Tutor LMS endpoints (e.g., REST API or admin-ajax.php) with sequentially or randomly enumerated object IDs from a single authenticated user session.
• Logs: Unusual access patterns where a low-privileged user account accesses resources associated with many different user IDs or course IDs in a short time window.
• Network: Automated or scripted HTTP requests to LMS data endpoints with incrementing or varying ID parameters, potentially indicating enumeration activity.

Users should update the Tutor LMS plugin to a version beyond 3.9.4, which addresses this IDOR vulnerability. Site administrators should review user roles and permissions within the LMS to ensure the principle of least privilege is enforced. Until patching is possible, consider restricting plugin functionality or access to sensitive LMS endpoints via a web application firewall (WAF) rule that limits access based on authenticated user context (Patchstack, ENISA EUVD).

The vulnerability was covered in Sucuri's March 2026 vulnerability patch roundup, indicating it received attention in the WordPress security community (Sucuri Blog). No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.