Skip to content
Sign in
7.1 High

CVE-2024-5784 The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a…

Description

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS Pro 2.7 earliest → 2.7.2 No fix stated
Tutor LMS Pro 2.7 earliest → 2.7.2 No fix stated

Other CVEs of Tutor LMS Pro

The 4 CVEs of Tutor LMS Pro →
CVE-2024-4352 The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of… 8.8 High CVE-2024-4222 The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of… 7.3 High CVE-2024-4351 The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of… 8.8 High
Track this CVE