Unauthorized Access to Data in Tutor LMS Pro Plugin for WordPress

CVE-2024-4351

Summary

The Tutor LMS Pro plugin for WordPress is susceptible to an unauthorized access flaw due to a lack of capability checks within the 'authenticate' function. This vulnerability, present in all versions up to and including 2.7.0, allows authenticated users, even those with subscriber-level permissions, to potentially manipulate or take control of an administrator account. Given the expansive use of the plugin, this security issue raises serious concerns about data integrity and user privacy across affected WordPress installations.

References