CVE-2024-1804

Name of the Vulnerable Software and Affected Versions The Tutor LMS – Migration Tool plugin for WordPress versions up to, and including, 2.2.0

Description The issue allows authenticated attackers with subscriber-level access and above to import courses due to a missing capability check on the tutor import from xml function. This enables unauthorized modification of data.

Recommendations For versions up to, and including, 2.2.0, update to a version that includes a fix for the missing capability check on the tutor import from xml function to prevent unauthorized data modification. As a temporary workaround, consider restricting access to the tutor import from xml function to prevent exploitation.