5.4
Moyenne
CVE-2025-6639 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object…
Description
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Tutor LMS Pro 3.8 | premières → 3.8.3 | Pas de correctif indiqué |
Autres CVE de Tutor LMS Pro
Les 9 CVE de Tutor LMS Pro →
CVE-2026-22332
Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions
9.3
Critique
CVE-2026-25406
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows…
8.1
Élevée
CVE-2026-0953
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
9.8
Critique
CVE-2025-6184
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL…
8.8
Élevée