CVE-2023-3133

Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Affected

Tutor LMS

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.98% chance of exploitation in the next 30 days, 62nd percentile

Published

2023-07-04

Updated

2024-11-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5

Security advisories

• https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
• https://wordpress.org/plugins/tutor

References

• CVE Record
• NVD entry