CVE-2021-24184: Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24184?
CVE-2021-24184 is a vulnerability in the Tutor LMS WordPress plugin that allows students to modify course information and elevate their privileges.
What is the severity of CVE-2021-24184?
CVE-2021-24184 has a severity rating of 8.8 (high).
How does CVE-2021-24184 affect Tutor LMS?
CVE-2021-24184 affects Tutor LMS versions before 1.7.7 and leaves several AJAX endpoints unprotected.
How can students exploit CVE-2021-24184?
Students can exploit CVE-2021-24184 to modify course information, elevate their privileges, and perform other unauthorized actions.
Are there any patches available for CVE-2021-24184?
Yes, there are patches available for CVE-2021-24184. Users should update to Tutor LMS version 1.7.7 or later to fix the vulnerability.