CVE-2024-4223: Tutor LMS <= 2.7.0 - Missing Authorization
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Tutor LMSto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4223?
CVE-2024-4223 is considered a high severity vulnerability due to the potential for unauthorized access and data modification.
How do I fix CVE-2024-4223?
To fix CVE-2024-4223, update the Tutor LMS plugin to version 2.7.1 or later.
Which versions of the Tutor LMS plugin are affected by CVE-2024-4223?
CVE-2024-4223 affects all versions of the Tutor LMS plugin up to and including 2.7.0.
What kind of data can be compromised due to CVE-2024-4223?
CVE-2024-4223 can lead to unauthorized access, modification, and potential loss of sensitive data within the Tutor LMS plugin.
Who is at risk due to CVE-2024-4223?
Website administrators and users utilizing affected versions of the Tutor LMS plugin on WordPress are at risk of this vulnerability.