CVE-2024-3553

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
CVSS

No CVSS.

Configurations

Configuration 1 (hide)

cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*

History

15 Jan 2025, 18:36

Type Values Removed Values Added
CWE CWE-862
CVSS v2 : unknown
v3 : 6.5
v2 : unknown
v3 : unknown
References () https://plugins.trac.wordpress.org/changeset/3076302/tutor/tags/2.7.0/classes/User.php - () https://plugins.trac.wordpress.org/changeset/3076302/tutor/tags/2.7.0/classes/User.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc?source=cve - Third Party Advisory
CPE cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*
First Time Themeum
Themeum tutor Lms

02 May 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-02 17:15

Updated : 2025-01-15 18:36


NVD link : CVE-2024-3553

Mitre link : CVE-2024-3553


JSON object : View

Products Affected

themeum

  • tutor_lms
CWE
CWE-862

Missing Authorization