Arbitrary Quiz Attempt Deletion Vulnerability in The Tutor LMS
CVE-2024-5438
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 7 June 2024
What is CVE-2024-5438?
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
Affected Version(s)
Tutor LMS – eLearning and online course solution * <= 2.7.1