PT-2021-15730
CVE-2021-24184
·
Published
2021-04-05
·
Updated
2022-05-03
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.7.7
Description:
The issue concerns unprotected AJAX endpoints in the plugin, which allows students to modify course information and elevate their privileges, among other actions.
Recommendations:
For versions prior to 1.7.7, update to version 1.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the unprotected AJAX endpoints until the update is applied.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾