CVE-2024-4223
Assigner: Wordfence
Published: 2024-05-16T08:32:50.538Z
State: PUBLISHED
affected: vendor: themeum
product: Tutor LMS – eLearning and online course solution
versions: version: *
status: affected
lessThanOrEqual: 2.7.0
versionType: semver
defaultStatus: unaffected
descriptions: value: The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
title: Tutor LMS <= 2.7.0 - Missing Authorization
problemTypes: descriptions: description: CWE-862 Missing Authorization
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
credits: type: finder
value: Villu Orav
timeline: time: 2024-05-15T00:00:00.000+00:00
value: Disclosed