CVE-2024-1798: Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutorlpexportxml function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to export courses, including private and password protected courses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1798?
The severity of CVE-2024-1798 is considered high due to the risk of unauthorized access to sensitive data.
How do I fix CVE-2024-1798?
To fix CVE-2024-1798, update the Tutor LMS – Migration Tool plugin to version 2.2.1 or later.
Who is affected by CVE-2024-1798?
All users of the Tutor LMS – Migration Tool plugin for WordPress versions up to and including 2.2.0 are affected by CVE-2024-1798.
What kind of data can be accessed due to CVE-2024-1798?
CVE-2024-1798 allows unauthorized attackers to export course data from the WordPress site.
Is authentication required to exploit CVE-2024-1798?
No, exploitation of CVE-2024-1798 does not require authentication, making it particularly dangerous.