CVE-2023-3133 | BDVDB-2026-206176 Detail

Tutor LMS

Description#

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-639 Authorization Bypass Through User-Controlled Key

References#

https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5
https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
https://wordpress.org/plugins/tutor/

Exploit#

https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5

History#

Version 12023-07-04Record published in the CVE List.
Version 22024-11-21Most recent update recorded in the CVE List.