CVE-2024-43142 — Tutor LMS – eLearning and online course solution [tutor] < 2.7.4

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2024-43142	Tutor LMS – eLearning and online course solution [tutor] < 2.7.4	Missing Authorization	High 8.8	< 2.7.4	2.7.4	2024-08-07	—

CVE-2024-43142

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_or_update_annoucement, tutor_quiz_save, tutor_load_edit_lesson_modal, and tutor_modal_create_or_update_lesson functions in versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to modify data they should not have access to.

Source: Wordfence

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)