CVE-2025-47555

Executive Summary

CVE-2025-47555 is an Authorization Bypass Through User-Controlled Key vulnerability in the Tutor LMS WordPress plugin by Themeum, affecting versions up to and including 3.9.4. This flaw allows an authenticated attacker (with low privileges, such as a student) to manipulate a user-controlled key (likely a numeric ID or UUID) in API requests or direct object references, thereby gaining unauthorized read access to sensitive data belonging to other users or courses. The vulnerability stems from incorrectly configured access control security levels within the plugin’s REST API or AJAX handlers, where the server fails to verify that the requesting user owns or is authorized to access the resource identified by the key.

Given the CVSS score of 3.8 (Low) and EPSS score of 0.0%, this vulnerability is currently not under active exploitation. However, the lack of a vendor patch and the widespread use of Tutor LMS (over 100,000 active installations) make it a latent risk for data leakage in WordPress ecosystems. The attack vector is network-based, requires low complexity, and only low privileges, but the impact is limited to confidentiality (low) with no effect on integrity or availability.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory and Themeum’s own channels. As a PHP-based plugin, it is not part of a package manager like NPM, PyPI, Go, or Ruby. However, the risk extends to the WordPress supply chain: site administrators who auto-update plugins may inadvertently remain vulnerable if the vendor does not release a patch. Additionally, third-party themes or plugins that depend on Tutor LMS’s API endpoints could inherit this authorization flaw.

CVSS Breakdown & Threat Level

Threat Level: Low. The vulnerability requires authentication and only exposes limited data. However, in a multi-tenant LMS environment (e.g., a university), an attacker could enumerate student records, course progress, or private messages.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (IDOR) or Authorization Bypass Through User-Controlled Key (CWE-639). In Tutor LMS, many API endpoints (e.g., /wp-json/tutor/v1/quiz-attempts, /wp-json/tutor/v1/students/{id}) accept a numeric ID or UUID as a parameter to fetch or modify resources. The plugin fails to validate that the authenticated user has permission to access the resource associated with that key.

Example vulnerable endpoint (hypothetical based on common Tutor LMS patterns):

GET /wp-json/tutor/v1/quiz-attempts/12345

A student user with ID 5 can change the 12345 to 12346 and retrieve another student’s quiz attempt details, including answers and scores.

The root cause is that the plugin’s permission checks only verify the user’s role (e.g., “is user a student?”) but do not compare the resource owner ID against the current user ID. This is a common oversight in WordPress plugin development when using get_current_user_id() only for role checks, not for ownership checks.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on best practices.

Vulnerable Code (PHP):

// In tutor-lms/includes/class-quiz.php
public function get_quiz_attempt($attempt_id) {
    // No ownership check
    global $wpdb;
    $attempt = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}tutor_quiz_attempts WHERE attempt_id = %d",
        $attempt_id
    ));
    return $attempt;
}

Patched Code (Hypothetical):

// In tutor-lms/includes/class-quiz.php
public function get_quiz_attempt($attempt_id) {
    global $wpdb;
    $current_user_id = get_current_user_id();
    $attempt = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}tutor_quiz_attempts WHERE attempt_id = %d AND user_id = %d",
        $attempt_id,
        $current_user_id
    ));
    if (!$attempt) {
        return new WP_Error('forbidden', 'You do not have permission to view this attempt.', array('status' => 403));
    }
    return $attempt;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Tutor LMS <= 3.9.4 installed.
• A valid low-privilege user account (e.g., student).

Step-by-step exploitation:

1. Authenticate as a student user and obtain a nonce or cookie.
2. Enumerate a valid resource ID (e.g., quiz attempt ID) by observing your own requests or using a simple loop.
3. Craft a request to a vulnerable endpoint, replacing the ID with a target user’s ID.

Example using cURL:

# Replace COOKIE with your session cookie
curl -X GET "https://target-site.com/wp-json/tutor/v1/quiz-attempts/12346" \
  -H "Cookie: wordpress_logged_in_abc123=student%7C..."

Expected output: The response returns the quiz attempt data of another user, including answers, scores, and timestamps.

Blue Team

Detection:

• Monitor for repeated API calls to /wp-json/tutor/v1/* with sequential or random numeric IDs from the same user.
• Look for 200 OK responses to resources that should be restricted (e.g., a student accessing admin quiz data).

Hunting query (Splunk):

index=web sourcetype=access_combined
uri_path="/wp-json/tutor/v1/*"
| stats count by src_ip, uri, status
| where status=200 and uri like "%quiz-attempts%" or uri like "%students%"

Lab setup:

• Use a local WordPress instance with Tutor LMS 3.9.4.
• Create two users: student1 and student2.
• As student1, take a quiz to generate an attempt ID.
• As student2, attempt to access student1’s attempt ID via the API.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-json/tutor/v1/quiz-attempts/{id} where {id} is not owned by the requester.
  • Repeated 403 errors followed by 200 OK on different IDs (indicating enumeration).
• Logs:
  • WordPress debug log entries: [28-Mar-2025 12:00:00 UTC] PHP Notice: Undefined index: user_id in /wp-content/plugins/tutor-lms/includes/class-quiz.php on line 45
• File:
  • Modified tutor-lms/includes/class-quiz.php (if attacker patches locally).
• User:
  • A single user account making hundreds of API calls to different resource IDs in a short time.

Detection Engineering

YARA Rule

rule CVE_2025_47555_Tutor_LMS_IDOR {
    meta:
        description = "Detects vulnerable Tutor LMS code with missing ownership checks"
        author = "Valters IT"
        date = "2025-03-28"
        reference = "CVE-2025-47555"
    strings:
        $s1 = "get_quiz_attempt" ascii wide nocase
        $s2 = "WHERE attempt_id = %d" ascii wide nocase
        $s3 = "user_id" ascii wide nocase
    condition:
        all of ($s1, $s2) and not $s3
}

Sigma Rule

title: CVE-2025-47555 - Tutor LMS IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of authorization bypass in Tutor LMS by monitoring for sequential ID access patterns.
author: Valters IT
date: 2025-03-28
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/wp-json/tutor/v1/"
    condition: selection
    timeframe: 5m
    aggregation:
        - field: c-ip
          function: distinct_count
          value: cs-uri-query
          condition: gt 10
falsepositives:
    - Legitimate admin bulk operations
    - Plugin internal cron jobs
level: medium
tags:
    - attack.t1190
    - cve.2025.47555

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-47555 - Tutor LMS IDOR Attempt";
    flow:to_server,established;
    content:"/wp-json/tutor/v1/";
    http_uri;
    pcre:"/\/wp-json\/tutor\/v1\/(quiz-attempts|students|courses)\/\d+/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-47555;
)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable endpoints via a custom plugin or .htaccess rewrite until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests with sequential IDs to Tutor LMS API endpoints.
3. Restrict API access to only necessary roles using WordPress capabilities.

Long-term Fix:

• Apply the hypothetical patch shown in the “Vulnerable vs. Patched Code” section.
• Contact Themeum support and request an official patch.
• Monitor the WordPress Plugin Directory for updates.

Workaround:

• Use a plugin like “User Role Editor” to remove the read capability from student roles, but this may break legitimate functionality.

Valters IT – Securing WordPress ecosystems one CVE at a time.