Vulnerability · Published May 2, 2024 · Assigned by Wordfence
CVE-2024-3553Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
Medium 6.5
In plain English
A medium-severity missing authorization in Tutor LMS – eLearning and online course solution from themeum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| themeum | Tutor LMS – eLearning and online course solution | 0 – through 2.6.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N