CVE-2024-10393 | BDVDB-2026-256247 Detail

Description#

The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12024-11-21Record published in the CVE List.
2. Version 22026-04-08Most recent update recorded in the CVE List.