Now officially on WordPress.org

CVE Database / CVE-2024-1503

CVE · Medium

CVE-2024-1503 — Tutor LMS – eLearning and online course solution [tutor] < 2.6.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-1503 Tutor LMS – eLearning and online course solution [tutor] < 2.6.2 Cross-Site Request Forgery (CSRF) Medium 4.3 < 2.6.2 2.6.2 2024-03-12 —

CVE-2024-1503

The Tutor LMS plugin for WordPress versions up to 2.6.1 contains a cross-site request forgery vulnerability in the erase_tutor_data() function due to inadequate nonce checks. An unauthenticated attacker could exploit this flaw to trick an administrator into clicking a malicious link, resulting in plugin deactivation and complete data erasure, provided the "Erase upon uninstallation" setting is active. The vulnerability was addressed in version 2.6.2.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings