CVE Database /
CVE-2024-4279
CVE · Medium
CVE-2024-4279 — Tutor LMS – eLearning and online course solution [tutor] < 2.7.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4279
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.1 |
Authorization Bypass Through User-Controlled Key |
Medium
6.5
|
< 2.7.1
|
2.7.1 |
2024-05-15 |
—
|
CVE-2024-4279
The Tutor LMS plugin for WordPress through version 2.7.0 contains an insecure direct object reference vulnerability in the tutor_course_delete function that fails to properly validate user-supplied input. Authenticated users with Instructor privileges or higher can exploit this flaw to delete arbitrary courses on the platform. The vulnerability was fixed in version 2.7.1.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings