Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
CVE-2021-24184
8.8HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 5 April 2021
What is CVE-2021-24184?
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Affected Version(s)
Tutor LMS – eLearning and online course solution 1.7.7