First published: Mon Apr 05 2021(Updated: )
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Themeum Tutor Lms | <1.7.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-24184 is a vulnerability in the Tutor LMS WordPress plugin that allows students to modify course information and elevate their privileges.
CVE-2021-24184 has a severity rating of 8.8 (high).
CVE-2021-24184 affects Tutor LMS versions before 1.7.7 and leaves several AJAX endpoints unprotected.
Students can exploit CVE-2021-24184 to modify course information, elevate their privileges, and perform other unauthorized actions.
Yes, there are patches available for CVE-2021-24184. Users should update to Tutor LMS version 1.7.7 or later to fix the vulnerability.