CVE-2024-5438

The Tutor LMS plugin through version 2.7.1 contains an Insecure Direct Object Reference vulnerability in the 'attempt_delete' function that allows authenticated users with Instructor privileges or higher to remove any quiz attempt without proper authorization checks. The flaw stems from insufficient validation of user-supplied parameters that identify which attempts should be deleted. Attackers exploiting this weakness could tamper with course records by eliminating quiz submissions belonging to other students. The vulnerability was resolved in version 2.7.2.

Based on public CVE data (MITRE/NVD).