CVE-2021-24184CWE-862

Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

published April 5, 2021

CVSS
—
EPSS
1%
Percentile
73.0
In the wild
Unconfirmed
What it is

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01439 · 73.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
    cvelistv5