CVE-2025-11564

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-115657.3CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system CVE-2025-115666.9CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to CVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is n CVE-2025-115684.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker wit CVE-2025-11576.3A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the CVE-2025-115704.6Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficie CVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to exec CVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciall CVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects Mongo CVE-2025-115764.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versi CVE-2025-115777.6Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Polic CVE-2025-115787.2A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root