CVE-2025-11564

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11564", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-09T14:26:27.293Z", "datePublished": "2025-10-25T05:31:19.940Z", "dateUpdated": "2026-04-08T16:42:37.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:37.294Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the \"verifyAndCreateOrderData\" function \r\nin all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'."}], "title": "Tutor LMS \u2013 eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-09-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-09T14:42:41.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-24T16:53:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:48:45.707365Z", "id": "CVE-2025-11564", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:49:09.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11564", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:48:45.707365Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:48:58.374Z"}}], "cna": {"title": "Tutor LMS \u2013 eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.8.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-09T14:42:41.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-24T16:53:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the \"verifyAndCreateOrderData\" function \r\nin all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-25T05:31:19.940Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11564", "state": "PUBLISHED", "dateUpdated": "2025-10-27T15:49:09.061Z", "dateReserved": "2025-10-09T14:26:27.293Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-25T05:31:19.940Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tutor LMS \u2013 eLearning and online course solution", "vendor": "themeum", "versions": [{"lessThanOrEqual": "3.8.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:themeum:tutor_lms:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "D66EBFF5-F51F-4A4E-85F5-321FAB6AD260", "versionEndExcluding": "3.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the \"verifyAndCreateOrderData\" function \r\nin all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'."}, {"lang": "es", "value": "El plugin de soluci\u00f3n de eLearning y cursos en l\u00ednea Tutor LMS para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante al verificar firmas de webhook en la funci\u00f3n 'verifyAndCreateOrderData' en todas las versiones hasta la 3.8.3, inclusive. Esto permite a atacantes no autenticados eludir la verificaci\u00f3n de pagos y marcar pedidos como pagados al enviar solicitudes de webhook falsificadas con 'payment_type' establecido en 'recurring'."}], "id": "CVE-2025-11564", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11564", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:48:45.707365Z", "version": "2.0.3"}}]}, "published": "2025-10-25T06:15:35.307", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323"}, {"source": "security@wordfence.com", "tags": ["Product", "Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:34:26.172742+00:00", "value": {"mitigation_remediation": ["Upgrade Tutor LMS to the latest release that includes the missing capability check, such as version 3.8.4 or later.", "Restrict the payment gateway webhook endpoint to trusted IP addresses or require an additional authentication header so that only legitimate webhook senders can reach it.", "Require a secret authentication token or valid HMAC signature in the webhook request before updating any order status to prevent unauthenticated requests."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Payment Status Update"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Tutor LMS \u2013 eLearning and online course solution plugin published by themeum. All releases up to and including version 3.8.3 are susceptible. No version information beyond this range is provided, so any installation of 3.8.3 or earlier is considered at risk.", "description_and_impact": "The Tutor LMS plugin for WordPress contains a missing capability check during webhook signature verification. This flaw allows an unauthenticated user to forge a payment webhook request with the field payment_type set to 'recurring', causing the plugin to mark the order as paid without validating the caller. The attacker can thus create false payment records, potentially gaining access to paid content and generating fraudulent revenue entries.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of real\u2011world exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the payment gateway webhook endpoint, with a forged payload that bypasses signature validation. Because no authentication is required, an attacker with internet access could submit the malicious request directly to the vulnerable site."}}}}, "created": "2025-10-27T22:10:12.167170+00:00", "updated": "2026-04-27T23:45:15.883661+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}