Unauthorized Access to Data in Tutor LMS Pro Plugin for WordPress

CVE-2024-4222

What is CVE-2024-4222?

The Tutor LMS Pro plugin for WordPress has a vulnerability that allows unauthorized users to gain access to sensitive data and perform unauthorized actions within the system. This issue arises from a missing capability check across multiple functions, impacting all versions up to and including 2.7.0. As a result, unauthenticated attackers can modify or delete user metadata and alter plugin options, raising significant concerns regarding the integrity and security of user data.

References