Analysis Report · Folder Analysis cache/tutor_3.9.3 → cache/tutor_3.9.4 — CVE-2025-13934

# Security Analysis: classes/Course.php

## Vulnerability 1: Enrollment Bypass Prevention

Vulnerability Existed: yes
FALSE POSITIVE
**Broken Access Control - CWE-639** - classes/Course.php lines 2122-2124

**Old Code:**
```php
// No enrollment check existed before course completion
$can_complete = apply_filters( 'tutor_user_can_complete_course', true, $user_id, $course_id );
```

**Fixed Code:**
```php
if ( ! tutor_utils()->is_enrolled( $course_id, $user_id ) ) {
    die( esc_html__( 'User is not enrolled in course', 'tutor' ) );
}

$can_complete = apply_filters( 'tutor_user_can_complete_course', true, $user_id, $course_id );
```

**Explanation:**
A critical access control vulnerability existed where unauthenticated or non-enrolled users could mark a course as complete without actually being enrolled. The fix adds an enrollment verification check that terminates execution if the user is not enrolled in the course, preventing unauthorized course completion.

---

## Vulnerability 2: Paid Course Enrollment Bypass

Vulnerability Existed: yes
TRUE POSITIVE
**Broken Access Control / Improper Authorization - CWE-639** - classes/Course.php lines 3010-3020

**Old Code:**
```php
if ( $password_protected ) {
    wp_send_json_error( __( 'This course is password protected', 'tutor' ) );
}
// Directly enrolls user without checking if course is paid or user purchased it
$enroll = tutor_utils()->do_enroll( $course_id, 0, $user_id );
```

**Fixed Code:**
```php
if ( $password_protected ) {
    wp_send_json_error( __( 'This course is password protected', 'tutor' ) );
}

if ( tutor_utils()->is_course_purchasable( $course_id ) ) {
    $is_enrolled = (bool) tutor_utils()->is_enrolled( $course_id, $user_id );
    
    if ( ! $is_enrolled ) {
        wp_send_json_error( __( 'Please purchase the course before enrolling', 'tutor' ) );
    }
}

$enroll = tutor_utils()->do_enroll( $course_id, 0, $user_id );
```

**Explanation:**
A significant authorization bypass vulnerability existed in the AJAX enrollment endpoint. Users could enroll in paid courses without purchasing them by directly calling the enrollment function. The fix adds a check to verify that if a course is purchasable (paid), the user must already be enrolled (which occurs automatically upon purchase). This prevents unauthorized enrollment in premium courses.