CVE-2024-4223: The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on…

PriorityP357critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.52%

40.3th percentile

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
themeum	tutor_lms	< 2.7.1	2.7.1
themeum	tutor_lms_elearning_and_online_course_solution	<= 2.7.0	—

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability allows unauthenticated attackers to invoke privileged functions due to missing capability checks on multiple functions in the Tutor LMS WordPress plugin (versions up to and including 2.7.0), enabling unauthorized add, modify, or delete of data. ↗

·All versions of the Tutor LMS WordPress plugin up to and including 2.7.0 are affected; the missing capability check exists on multiple functions, so detection should cover any unauthenticated requests to Tutor LMS AJAX/REST endpoints. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.