CVE-2024-4279: Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutorcoursedelete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tutor LMS – eLearning and online course solution plugin for WordPressto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4279?
CVE-2024-4279 has a critical severity due to its potential to allow unauthorized deletion of courses.
How do I fix CVE-2024-4279?
To fix CVE-2024-4279, update the Tutor LMS plugin to version 2.7.1 or later.
What are the potential impacts of CVE-2024-4279?
CVE-2024-4279 could allow attackers to delete arbitrary courses from the site, leading to data loss.
Which versions of Tutor LMS are affected by CVE-2024-4279?
Versions of Tutor LMS up to and including 2.7.0 are affected by CVE-2024-4279.
What is the nature of the vulnerability in CVE-2024-4279?
CVE-2024-4279 is an Insecure Direct Object Reference vulnerability that lacks proper validation on user-controlled keys.