Unauthorized Access and SQL Injection Vulnerabilities in Tutor LMS Pro Plugin for WordPress

CVE-2024-4352

What is CVE-2024-4352?

The Tutor LMS Pro plugin for WordPress is susceptible to unauthorized data access and SQL Injection due to a missing capability check within the 'get_calendar_materials' function. This flaw permits authenticated attackers, even those with subscription-level permissions, to exploit the vulnerable function. Attackers can manipulate the 'year' parameter, leading to inadequate escaping of user-supplied values and insufficient SQL query preparation. Such exploitation can enable unauthorized modification and extraction of sensitive data, posing significant security risks for WordPress sites using this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References