Unauthorized Access to Administrative Actions on Tutor LMS Pro Plugin for WordPress

CVE-2024-5784

What is CVE-2024-5784?

The Tutor LMS Pro plugin for WordPress contains a significant vulnerability that permits unauthorized execution of administrative actions. This issue arises from the absence of capability checks on several critical functions, such as treport_quiz_attempt_delete and tutor_gc_class_action. As a result, authenticated attackers with subscriber-level access or higher can execute potentially harmful actions, including deleting comments, posts, or users, and viewing sensitive notifications. Site administrators must promptly update to version 2.7.3 or later to mitigate this risk and protect their WordPress installations from exploitation.

References