Listen to this Post
The CVE-2025-11564 vulnerability stems from an insecure webhook handler in the Tutor LMS plugin. The `verifyAndCreateOrderData` function, responsible for processing payment notifications from gateways, fails to perform a proper capability check on incoming requests. Crucially, while it attempts to verify a signature, the logic can be bypassed when an attacker sets the `payment_type` parameter to ‘recurring’. This flaw allows unauthenticated individuals to send forged webhook payloads directly to the vulnerable endpoint. The system, trusting this forged data, will then inappropriately update the WordPress database to change an order’s status to ‘paid’ without any actual monetary transaction, leading to complete payment bypass.
Platform: WordPress Plugin
Version: <= 3.8.3
Vulnerability: Payment Bypass
Severity: Critical
date: 2025-10-25
Prediction: Patch by 2025-11-15
What Undercode Say:
curl -X POST "https://target.com/wp-json/tutor/v1/webhook/order" -H "Content-Type: application/json" -d '{"payment_type":"recurring", "order_id":"123", "status":"completed"}'
grep -r "verifyAndCreateOrderData" /path/to/plugin/
wp option list --search="tutor_" --format=table
How Exploit:
- Attacker identifies a target site using Tutor LMS <= v3.8.3.
- Crafts a malicious HTTP POST request to the `/wp-json/tutor/v1/webhook/order` endpoint.
- Sets the JSON body parameter `”payment_type”:”recurring”` and includes a valid
order_id. - The plugin processes the request, bypasses signature verification, and marks the specified order as paid.
Protection from this CVE:
- Immediate update to Tutor LMS plugin version beyond 3.8.3.
- Implement a Web Application Firewall (WAF) rule to block unauthorized POST requests to the affected webhook endpoint.
- Add strict signature verification for all webhook types, including ‘recurring’.
Impact:
Financial loss, course access theft, violation of order integrity, reputational damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
