PT-2023-23292 · WordPress · Tutor Lms

A. S. M. Muhiminul Hasan · Published 2023-07-04 · Updated 2023-07-11 · CVE-2023-3133

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tutor LMS WordPress plugin versions prior to 2.2.1

Description The issue concerns inadequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API endpoints until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-3133

Affected Products

Tutor Lms

References · 7

• 🔥 https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 · Exploit
• https://osv.dev/vulnerability/CVE-2023-3133 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-3133 · Security Note
• https://t.me/cvenotify/54067 · Telegram Post
• https://wordpress.org/plugins/tutor · Note
• https://t.me/cvenotify/53629 · Telegram Post