Attack Chain

1. Attacker identifies a WordPress site using a vulnerable version (<= 3.9.7) of the Tutor LMS plugin.
2. Attacker enumerates or guesses valid order_id values for incomplete manual orders. These IDs are integers and could be found by observing order numbers.
3. Attacker crafts a POST request to the /wp-admin/admin-ajax.php endpoint, targeting the pay_incomplete_order action.
4. The POST request includes the vulnerable order_id parameter and malicious billing data (name, email, phone, address). The request also requires a valid _tutor_nonce.
5. The server-side pay_incomplete_order() function processes the request without verifying the attacker's identity or authorization to modify the target user's billing information.
6. The function retrieves the order data associated with the provided order_id.
7. The function uses $order_data->user_id and writes the attacker-supplied billing details to the profile of the order owner.
8. The targeted user's billing profile is updated with the attacker's data, potentially leading to account takeover or financial fraud.

Impact

Successful exploitation of CVE-2026-3360 allows unauthenticated attackers to overwrite sensitive billing information associated with user accounts within a WordPress site using the vulnerable Tutor LMS plugin. The potential impact includes unauthorized modification of user profiles, which can facilitate phishing attacks, identity theft, or financial fraud if the compromised billing information is linked to payment methods. Since the vulnerability exists in a plugin designed for online courses, the targeted sectors are likely education, training, and e-learning platforms.

Recommendation

• Upgrade the Tutor LMS plugin to the latest version, which includes a patch for CVE-2026-3360, to remediate the vulnerability.
• Implement the Sigma rule Tutor LMS Insecure Order ID Access to detect attempts to exploit this vulnerability by monitoring for suspicious POST requests to the admin-ajax.php endpoint.
• Implement the Sigma rule Tutor LMS Billing Profile Update to detect unauthorized billing profile updates via the vulnerable endpoint.
• Monitor web server logs for POST requests to /wp-admin/admin-ajax.php with the action parameter set to pay_incomplete_order and investigate any unexpected activity.