CVE-2025-13935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13935", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-02T22:22:21.248Z", "datePublished": "2026-01-09T07:22:11.913Z", "dateUpdated": "2026-04-08T17:02:31.130Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:31.130Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed."}], "title": "Tutor LMS \u2013 eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8b111a-9626-41f4-8a13-51f576af0257?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422766/tutor/trunk/classes/Course.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2025-12-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-02T22:38:12.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T18:44:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T18:10:36.671555Z", "id": "CVE-2025-13935", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:10:43.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T18:10:36.671555Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:10:39.946Z"}}], "cna": {"title": "Tutor LMS \u2013 eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS \u2013 eLearning and online course solution", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.9.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-02T22:38:12.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T18:44:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8b111a-9626-41f4-8a13-51f576af0257?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422766/tutor/trunk/classes/Course.php"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-09T07:22:11.913Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13935", "state": "PUBLISHED", "dateUpdated": "2026-01-09T18:10:43.988Z", "dateReserved": "2025-12-02T22:22:21.248Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T07:22:11.913Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tutor LMS \u2013 eLearning and online course solution", "vendor": "themeum", "versions": [{"lessThanOrEqual": "3.9.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed."}, {"lang": "es", "value": "El plugin de soluci\u00f3n de eLearning y cursos en l\u00ednea Tutor LMS para WordPress es vulnerable a la finalizaci\u00f3n de cursos no autorizada en todas las versiones hasta la 3.9.2, inclusive. Esto se debe a la falta de verificaci\u00f3n de inscripci\u00f3n en la funci\u00f3n 'mark_course_complete'. Esto permite a atacantes autenticados, con acceso de nivel suscriptor y superior, marcar cualquier curso como completado."}], "id": "CVE-2025-13935", "lastModified": "2026-06-17T08:35:00.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13935", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T18:10:36.671555Z", "version": "2.0.3"}}]}, "published": "2026-01-09T08:15:57.170", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3422766/tutor/trunk/classes/Course.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8b111a-9626-41f4-8a13-51f576af0257?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T06:03:55.404410+00:00", "value": {"mitigation_remediation": ["Update Tutor LMS to version 3.9.3 or later", "Audit course completion records for irregularities and revert any unauthorized completions", "Restrict subscriber users from marking courses as complete by enforcing role\u2011based access control and limiting the mark_course_complete action to instructors or administrators"], "summary": {"action": "Patch Plugin", "impact": "Arbitrary completion of any course by authenticated users with subscriber-level access"}, "threat_synthesis": {"affected_systems": "WordPress installations running the Tutor LMS eLearning plugin up to and including version 3.9.2 are impacted. Version 3.9.3 and later include the fix.", "description_and_impact": "The vulnerability lies in the absence of enrollment verification within the mark_course_complete routine of the Tutor LMS plugin. This flaw is a CWE-862 (Missing Authorization) weakness that allows authenticated users with at least subscriber privileges to mark any course as finished, regardless of whether they are actually enrolled. The consequence is that enrolled students may see false progress, instructors cannot rely on completion data, and grading or certification processes that depend on completion status may be compromised.", "risk_and_exploitability": "The CVSS score of 4.3 reflects a low to moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to be either a normal subscriber or higher, which most sites will allow. Once authenticated, the attacker can submit a request that triggers the missing authorization check, causing the specified course to be marked complete with no additional requirements."}}}}, "created": "2026-01-09T13:23:28.508764+00:00", "updated": "2026-04-22T06:15:10.425027+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}