CVE-2023-2919

The Tutor LMS plugin for WordPress before version 2.7.5 contains a cross-site request forgery vulnerability in the addon enable/disable functionality. An attacker could exploit inadequate nonce validation to craft a malicious request that, if clicked by an administrator, would allow the attacker to toggle addons on or off without proper authorization. This attack requires social engineering to trick an authenticated admin user into visiting a link controlled by the attacker.

Based on public CVE data (MITRE/NVD).