CVE-2024-4351CWE-89

Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation

High · published May 16, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01014 · 62.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-05-16T09:32Z
EPSS history
Timeline
  • 16 MAY 09:32Z
    Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
    cvelistv5