CVE-2024-5438: Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attemptdelete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tutor LMS – eLearning and online course solution plugin for WordPressto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5438?
CVE-2024-5438 has a medium severity rating due to the potential unauthorized access to sensitive information.
How do I fix CVE-2024-5438?
To fix CVE-2024-5438, update the Tutor LMS plugin to version 2.7.2 or later, which addresses the vulnerability.
What versions of Tutor LMS are affected by CVE-2024-5438?
CVE-2024-5438 affects all versions of Tutor LMS up to and including 2.7.1.
What type of vulnerability is CVE-2024-5438?
CVE-2024-5438 is classified as an Insecure Direct Object Reference vulnerability.
Can CVE-2024-5438 lead to data breaches?
Yes, CVE-2024-5438 can potentially lead to unauthorized access and data breaches if not resolved.