CVE-2024-43142 — Tutor LMS – eLearning and online course solution [tutor] < 2.7.4

CVE-2024-43142

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_or_update_annoucement, tutor_quiz_save, tutor_load_edit_lesson_modal, and tutor_modal_create_or_update_lesson functions in versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to modify data they should not have access to.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence