CVE-2025-11564: Tutor LMS Auth Bypass Vulnerability

CVE-2025-11564 Overview

CVE-2025-11564 affects the Tutor LMS eLearning and online course solution plugin for WordPress. The vulnerability results from a missing capability check in the verifyAndCreateOrderData function within the PayPal payment gateway component. All versions up to and including 3.8.3 are affected [CWE-862].

Unauthenticated attackers can bypass payment verification by submitting forged webhook requests with payment_type set to recurring. This allows orders to be marked as paid without an actual payment being processed, resulting in unauthorized modification of order data.

Critical Impact
Unauthenticated attackers can mark Tutor LMS orders as paid by forging PayPal webhook requests, enabling free access to paid courses and subscriptions.

Affected Products

Themeum Tutor LMS (Free / WordPress) — all versions up to and including 3.8.3
WordPress sites using the Tutor LMS PayPal payment gateway
Sites accepting recurring payment order types via Tutor LMS webhooks

Discovery Timeline

2025-10-25 - CVE-2025-11564 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11564

Vulnerability Analysis

The flaw resides in the PayPal payment gateway integration of Tutor LMS, specifically the verifyAndCreateOrderData function located in ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php. This function handles inbound PayPal webhook notifications and creates or updates order records based on their contents.

The function performs webhook signature verification, but it fails to enforce a proper capability or authorization check when the request advertises a recurring payment type. An attacker can submit a crafted HTTP request with payment_type set to recurring and reach the order-update logic without proving legitimate origin from PayPal.

The issue is categorized as Missing Authorization [CWE-862]. It falls under the broader class of business logic and authorization bypass vulnerabilities affecting e-commerce workflows.

Root Cause

The root cause is the absence of a capability check on the webhook handler code path that processes recurring payment notifications. The code trusts attacker-controlled fields in the incoming request to determine subsequent order state changes. No verified server-to-server callback validation is applied for the recurring branch of the handler.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a forged HTTP POST request to the plugin's PayPal webhook endpoint containing an order identifier and payment_type=recurring. The plugin then updates the referenced order to a paid state, granting the attacker access to the associated course or subscription content.

The vulnerability manifests in the PayPal webhook handler. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-11564

Indicators of Compromise

Inbound POST requests to the Tutor LMS PayPal webhook endpoint containing payment_type=recurring from IP addresses not associated with PayPal.
Orders transitioning to a paid status in the Tutor LMS database without a corresponding PayPal transaction identifier or capture record.
Enrollment records for paid courses created for accounts with no legitimate payment history.

Detection Strategies

Review WordPress access logs for unauthenticated requests to the Tutor LMS PayPal webhook URI, especially those with the recurring payment type.
Reconcile Tutor LMS order records against the PayPal merchant transaction log to identify paid orders that lack a matching PayPal payment.
Alert on repeated webhook hits from a single source IP or user-agent that does not match PayPal's published sender ranges.

Monitoring Recommendations

Enable WordPress and web server access logging with full request bodies for /wp-json/ and Tutor LMS endpoints.
Monitor Tutor LMS order tables for status changes and correlate with PayPal IPN or webhook receipts.
Track new course enrollments tied to orders that have no financial reconciliation, and forward these events to a centralized SIEM for correlation.

How to Mitigate CVE-2025-11564

Immediate Actions Required

Update the Tutor LMS plugin to a version later than 3.8.3 as soon as the vendor publishes a fixed release.
Audit all Tutor LMS orders created since deploying vulnerable versions and reverse any orders that cannot be matched to a PayPal transaction.
Restrict access to the PayPal webhook endpoint at the web server or WAF layer to PayPal's documented sender IP ranges.

Patch Information

At the time of publication, the vulnerability is confirmed in Tutor LMS versions up to and including 3.8.3. Site administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for a patched release, then apply it immediately.

Workarounds

Temporarily disable the PayPal payment gateway in Tutor LMS if a patched version is not yet available.
Deploy a WAF rule that blocks unauthenticated requests to the Tutor LMS PayPal webhook URI when payment_type=recurring originates outside PayPal's sender IP ranges.
Disable the Tutor LMS plugin entirely on sites that do not actively require it until an update is applied.

bash

# Example nginx rule restricting the Tutor LMS PayPal webhook to PayPal IPs
location ~* /wp-json/tutor/.*/paypal {
    allow 173.0.80.0/20;   # PayPal published range (verify current list)
    allow 64.4.240.0/21;   # PayPal published range (verify current list)
    deny all;
}