CVE-2024-4223

CRITICAL 9.8 CVSS 3.1

Published: May 16, 2024
Last modified: June 17, 2026
NVD status: Modified
Reported by: security@wordfence.com
Weakness: CWE-862
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.

Affected products and versions

themeum Tutor LMS – eLearning and online course solution — Up to and including 2.7.0
themeum tutor_lms — Before 2.7.1

References

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3086489/ Patch
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References