CVE-2026-3360

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.

• CWE-862

• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/classes/Tutor.php#L563
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L1059
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.7/ecommerce/CheckoutController.php#L108
• https://plugins.trac.wordpress.org/browser/tutor/trunk/ecommerce/CheckoutController.php#L1059
• https://plugins.trac.wordpress.org/changeset/3496394/tutor/trunk/ecommerce/CheckoutController.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=cve

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33594A client can trigger excessive memory allocation by generati…7.5
• CVE-2026-33595A client can trigger excessive memory allocation by generati…7.5
• CVE-2026-33596A client might theoretically be able to cause a mismatch bet…6.5
• CVE-2026-33597PRSD detection denial of service7.5
• CVE-2026-33598A cached crafted response can cause an out-of-bounds read if…9.1
• CVE-2026-33599A rogue backend can send a crafted SVCB response to a Discov…8.1
• CVE-2026-33600An RPZ sent by a malicious authoritative server can result i…4.9
• CVE-2026-33601If you use the zoneToCache function with a malicious authori…4.9
• CVE-2026-33602A rogue backend can send a crafted UDP response with a query…8.2
• CVE-2026-33603Attacker can use a specially crafted base64 exchange between…5.3
• CVE-2026-33608An attacker can send a notify request that causes a new seco…9.8
• CVE-2026-33609Incomplete escaping of LDAP queries when running with 8bit-d…6.5