{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-32223", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-04-04T10:01:50.054Z", "datePublished": "2026-03-19T08:05:59.217Z", "dateUpdated": "2026-04-01T15:50:30.826Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "tutor", "product": "Tutor LMS", "vendor": "Themeum", "versions": [{"changes": [{"at": "3.9.5", "status": "unaffected"}], "lessThanOrEqual": "3.9.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:38:39.036Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Tutor LMS: from n/a through <= 3.9.4.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T15:50:30.826Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-4-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve"}], "title": "WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T15:02:03.202503Z", "id": "CVE-2025-32223", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T15:02:51.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-32223", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T15:02:03.202503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T15:02:42.499Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "daroo | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Themeum", "product": "Tutor LMS", "versions": [{"status": "affected", "changes": [{"at": "3.9.5", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.9.4"}], "packageName": "tutor", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Tutor LMS Plugin to the latest available version (at least 3.9.5).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Tutor LMS Plugin to the latest available version (at least 3.9.5).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-4-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 3.9.4.", "supportingMedia": [{"type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Tutor LMS: from n/a through 3.9.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-19T08:05:59.217Z"}}}, "cveMetadata": {"cveId": "CVE-2025-32223", "state": "PUBLISHED", "dateUpdated": "2026-03-19T15:02:51.483Z", "dateReserved": "2025-04-04T10:01:50.054Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-19T08:05:59.217Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4."}, {"lang": "es", "value": "Vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n a trav\u00e9s de clave controlada por el usuario en Themeum Tutor LMS permite explotar niveles de seguridad de control de acceso incorrectamente configurados. Este problema afecta a Tutor LMS: desde n/a hasta 3.9.4."}], "id": "CVE-2025-32223", "lastModified": "2026-04-01T17:22:10.437", "metrics": {}, "published": "2026-03-19T09:16:15.477", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-4-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.9.5,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Tutor LMS", "source": "cna", "vendor": "Themeum"}, "product": "tutor_lms", "vendor": "themeum"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-19T09:24:08.197314+00:00", "value": {"mitigation_remediation": ["Update the WordPress Tutor LMS Plugin to version 3.9.5 or later.", "If patching is not immediately possible, disable or remove the vulnerable plugin to prevent exploitation.", "Monitor your site for unauthorized access attempts and review access logs after patching."], "summary": {"action": "Immediate Patch", "impact": "Insecure Direct Object Reference (IDOR) leading to unauthorized access"}, "threat_synthesis": {"affected_systems": "Any WordPress site that installs the Tutor LMS plugin up to and including version 3.9.4 is affected. The vulnerability applies to all builds from the first release (no beginning version specified) through 3.9.4. Sites using version 3.9.5 or newer are not affected.", "description_and_impact": "An authorization bypass via user\u2011controlled key, known as an IDOR, exists in the Themeum Tutor LMS WordPress plugin. The flaw allows an attacker to craft requests that reference protected objects such as course content or user data without proper access checks. This can lead to unauthorized viewing or modification of sensitive information, compromising confidentiality and integrity. The weakness corresponds to CWE\u2011639.", "risk_and_exploitability": "The CVSS score for this issue is 6.5, indicating a moderate severity. An EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog. The likely attack vector is through a web request where a malicious user supplies a manipulated object identifier; the vulnerability does not require elevated privileges beyond those of a normal site user. Attackers could gain unintended access to course material, user information, or administrative actions depending on how the plugin handles the object references."}}}}, "created": "2026-03-20T08:57:12.794067+00:00", "updated": "2026-03-20T14:15:36.286853+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}