CVE-2023-3133

UNRATED

Description

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Affected products

Unknown / Tutor LMS0 – 2.2.1

References

MISChttps://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5
MISChttps://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
MISChttps://wordpress.org/plugins/tutor/

Updated 4m ago · 8 sources