CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.