CVE-2021-24184
First published: Mon Apr 05 2021(Updated: )
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Themeum Tutor Lms | <1.7.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-24184?
CVE-2021-24184 is a vulnerability in the Tutor LMS WordPress plugin that allows students to modify course information and elevate their privileges.
What is the severity of CVE-2021-24184?
CVE-2021-24184 has a severity rating of 8.8 (high).
How does CVE-2021-24184 affect Tutor LMS?
CVE-2021-24184 affects Tutor LMS versions before 1.7.7 and leaves several AJAX endpoints unprotected.
How can students exploit CVE-2021-24184?
Students can exploit CVE-2021-24184 to modify course information, elevate their privileges, and perform other unauthorized actions.
Are there any patches available for CVE-2021-24184?
Yes, there are patches available for CVE-2021-24184. Users should update to Tutor LMS version 1.7.7 or later to fix the vulnerability.
- collector/nvd-index
- vendor/themeum
- product/tutor lms
- canonical/themeum tutor lms