CVE-2024-3553: Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3553?
CVE-2024-3553 has a medium severity rating due to the potential for unauthorized data modification.
How do I fix CVE-2024-3553?
To fix CVE-2024-3553, update the Tutor LMS plugin to version 2.7.0 or later.
What kind of attacks can exploit CVE-2024-3553?
CVE-2024-3553 can be exploited by unauthenticated attackers to modify user settings without proper authorization.
Which versions of Tutor LMS are affected by CVE-2024-3553?
CVE-2024-3553 affects all versions of Tutor LMS up to and including version 2.6.2.
Is user data at risk due to CVE-2024-3553?
Yes, CVE-2024-3553 poses a risk to user data as it allows unauthorized modifications.