CVE-2023-25799

Tutor LMS versions up to 2.1.8 contain a security flaw where several functions fail to properly verify user permissions before executing sensitive operations. This vulnerability allows any authenticated user with student-level privileges or higher to perform unauthorized actions including the deletion of arbitrary posts. The missing capability checks expose the plugin to potential data manipulation and loss by low-privileged attackers. The issue is resolved in version 2.1.9 and later.

Based on public CVE data (MITRE/NVD).