📄 Description (English)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.
🤖 AI Executive Summary
Tutor LMS plugin versions up to 3.9.7 contain an authorization bypass vulnerability allowing authenticated subscribers to enroll in private courses. While WordPress core prevents content access, the vulnerability exposes private course metadata and creates unauthorized enrollment records. This affects educational institutions and organizations using Tutor LMS for restricted course delivery in Saudi Arabia.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 28, 2026 09:19
🇸🇦 Saudi Arabia Impact Assessment
Primary impact on Saudi educational sector (universities, online training providers, corporate learning platforms). Secondary impact on government agencies using WordPress-based learning management systems for employee training. Healthcare sector at risk if using Tutor LMS for restricted medical education. Financial services and ARAMCO subsidiaries potentially affected if deploying internal training platforms. The vulnerability enables unauthorized visibility of private course enrollment and metadata, creating compliance issues with SAMA regulations for financial institutions and NCA requirements for government entities handling sensitive training content.
🏢 Affected Saudi Sectors
Education (Universities, Online Training Providers)
Government (Employee Training, Restricted Content Distribution)
Healthcare (Medical Education, Restricted Training)
Energy (ARAMCO subsidiaries, training platforms)
Telecommunications (STC, employee development)
Financial Services (Internal training platforms)
Corporate Training (All sectors using Tutor LMS)
🎯 MITRE ATT&CK Techniques
T1078 - Valid Accounts (authenticated subscriber exploitation)
T1548 - Abuse Elevation Control Mechanism (privilege escalation through missing validation)
T1526 - Reconnaissance (enumeration of private courses)
T1087 - Account Discovery (identification of course enrollment patterns)
T1530 - Data from Cloud Storage Object (exposure of private course metadata)
⚖️ Saudi Risk Score (AI)
6.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all Tutor LMS installations to identify private courses and current enrollments
2. Review enrollment logs for unauthorized access to private courses
3. Disable course enrollment functionality if not immediately patchable
COMPENSATING CONTROLS (until patch available):
1. Implement WordPress role-based access control: restrict Subscriber role capabilities
2. Add custom code to validate post_status in enrollment functions before processing
3. Deploy Web Application Firewall (WAF) rules to block POST requests to enrollment endpoints from non-privileged users
4. Implement database-level triggers to flag unauthorized private course enrollments
5. Use WordPress security plugins to add additional capability checks
DETECTION RULES:
1. Monitor wp_postmeta table for enrollment records where post_status='private'
2. Alert on POST requests to /wp-admin/admin-ajax.php with actions 'enroll_now' or 'course_enrollment' from Subscriber-level users
3. Track database INSERT operations on course enrollment tables with private course IDs
4. Monitor WordPress audit logs for enrollment activity on courses with private status
PATCHING GUIDANCE:
1. Contact Tutor LMS support for security patch timeline
2. Prepare staging environment for immediate patching once available
3. Implement change management process for plugin updates
4. Test thoroughly before production deployment
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع تثبيتات Tutor LMS لتحديد الدورات الخاصة والتسجيلات الحالية
2. مراجعة سجلات التسجيل للوصول غير المصرح به إلى الدورات الخاصة
3. تعطيل وظيفة التسجيل في الدورات إذا لم يكن من الممكن إصلاحها فوراً
الضوابط التعويضية (حتى توفر الإصلاح):
1. تنفيذ التحكم في الوصول القائم على الأدوار في WordPress: تقييد قدرات دور المشترك
2. إضافة رمز مخصص للتحقق من post_status في وظائف التسجيل قبل المعالجة
3. نشر قواعد جدار الحماية لتطبيقات الويب (WAF) لحظر طلبات POST لنقاط نهاية التسجيل من المستخدمين غير المميزين
4. تنفيذ محفزات على مستوى قاعدة البيانات لتحديد التسجيلات غير المصرح بها في الدورات الخاصة
5. استخدام مكونات أمان WordPress لإضافة فحوصات قدرة إضافية
قواعد الكشف:
1. مراقبة جدول wp_postmeta للبحث عن سجلات التسجيل حيث post_status='private'
2. تنبيه على طلبات POST إلى /wp-admin/admin-ajax.php مع إجراءات 'enroll_now' أو 'course_enrollment' من مستخدمي مستوى المشترك
3. تتبع عمليات INSERT في قاعدة البيانات على جداول التسجيل في الدورات برموز دورات خاصة
4. مراقبة سجلات تدقيق WordPress لنشاط التسجيل في الدورات ذات الحالة الخاصة
إرشادات الإصلاح:
1. الاتصال بدعم Tutor LMS لمعرفة الجدول الزمني لإصلاح الأمان
2. تحضير بيئة التجريب للإصلاح الفوري عند توفره
3. تنفيذ عملية إدارة التغيير لتحديثات المكون
4. الاختبار الشامل قبل نشر الإنتاج
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Access Control Policy (unauthorized course enrollment violates access control principles)
ECC 2024 A.5.2.1 - User Registration and Access Management (missing validation of user privileges)
ECC 2024 A.5.3.1 - Management of Privileged Access Rights (failure to enforce read_private_posts capability)
ECC 2024 A.8.1.1 - User Endpoint Devices (exposure of private course metadata)
🔵 SAMA CSF
SAMA CSF ID.AC-1 - Access Control (unauthorized access to private courses)
SAMA CSF PR.AC-1 - Processes and procedures for effective access control
SAMA CSF PR.AC-3 - Access enforcement based on need-to-know principle
SAMA CSF DE.AE-1 - Anomalies and events are detected and analyzed
🟡 ISO 27001:2022
ISO 27001:2022 A.5.2 - User access management (inadequate access control validation)
ISO 27001:2022 A.5.3 - Management of privileged access (missing capability checks)
ISO 27001:2022 A.8.1 - User endpoint devices and desktop/laptop computing (unauthorized access to restricted content)
ISO 27001:2022 A.8.2 - Privileged access rights (failure to enforce read_private_posts capability)
🔗 References & Sources 7
🔗
🔗
🔗
🔗
🔗
🔗
🔗
https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L134
security@wordfence.com
https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Course.php#L2066
security@wordfence.com
https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L2053
security@wordfence.com
https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L2989
security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/classes/Course.php
security@wordfence.com
https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7&new_path=%2Ft...
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c173356-7228-4253-bb28-2c2e1...
security@wordfence.com