CVE-2025-13628

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-09

Last updated on: 2026-01-09

Assigner: Wordfence

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-09

Last Modified

2026-01-09

Generated

2026-07-06

AI Q&A

2026-01-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13628

EUVD

EUVD-2026-1787

Affected Vendors & Products

Vendor	Product	Version / Range
themeum	tutor_lms	to 3.9.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in the Tutor LMS WordPress plugin allows authenticated users with subscriber level access or higher to modify or delete coupon data without proper authorization. This happens because the plugin's 'bulk_action_handler' and 'coupon_permanent_delete' functions lack adequate capability checks, enabling unauthorized deletion, activation, deactivation, or trashing of coupons. [2]

Impact Analysis

The vulnerability can lead to unauthorized modification or deletion of coupon data in the Tutor LMS plugin. Attackers with low-level authenticated access can delete or alter coupons, potentially causing financial loss, disruption of promotional campaigns, or damage to business operations relying on coupon functionality.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Tutor LMS plugin to version 3.9.4 or later, which includes improved capability checks in the 'bulk_action_handler' function and nonce verification to prevent unauthorized coupon modifications. This update replaces the previous direct capability check with a more robust permission verification method and adds CSRF protection, effectively addressing the vulnerability. [2]

Hi! I’m here to help you understand CVE-2025-13628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70