PT-2024-37150 · WordPress · Tutor Lms Pro

Thanh Nam Tran · Published 2024-08-29 · Updated 2024-09-03 · CVE-2024-5784

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: The Tutor LMS Pro plugin for WordPress versions up to, and including, 2.7.2

Description: The issue allows authenticated attackers with subscriber-level access and above to perform administrative actions on the site, such as deleting comments, posts, or users, and viewing notifications. This is due to missing capability checks on multiple functions like treport quiz atttempt delete and tutor gc class action.

Recommendations: For versions up to, and including, 2.7.2, update to a version that includes the necessary capability checks to prevent unauthorized administrative actions. As a temporary workaround, consider restricting access to the vulnerable functions treport quiz atttempt delete and tutor gc class action until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5784

Affected Products

Tutor Lms Pro

References · 10

• https://osv.dev/vulnerability/CVE-2024-5784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5784 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8?source=cve · Note
• https://twitter.com/CVEnew/status/1829366248313872705 · Twitter Post
• https://t.me/latest_high_impact_cve/1082 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1829394536096739738 · Twitter Post
• https://t.me/cvenotify/93055 · Telegram Post
• https://t.me/cvedetector/4495 · Telegram Post
• https://t.me/cvenotify/92776 · Telegram Post
• https://tutorlms.com/releases/id/299 · Note