CVE-2024-4223

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3086489/	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve	Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3086489/	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*

History

24 Jan 2025, 17:58

Type	Values Removed	Values Added
First Time		Themeum Themeum tutor Lms
CPE		cpe:2.3:a:themeum:tutor_lms::::::wordpress::*
CWE		CWE-862
References	~~() https://plugins.trac.wordpress.org/changeset/3086489/ -~~	() https://plugins.trac.wordpress.org/changeset/3086489/ - Patch
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve - Third Party Advisory

Information

Published : 2024-05-16 09:15

Updated : 2025-01-24 17:58

NVD link : CVE-2024-4223

Mitre link : CVE-2024-4223

CVE.ORG link : CVE-2024-4223

JSON object : View

Products Affected

themeum

tutor_lms

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-4223", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-05-16T09:15:15.810", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3086489/", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3086489/", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=cve", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data."}, {"lang": "es", "value": "El complemento Tutor LMS para WordPress es vulnerable al acceso no autorizado a datos, modificaci\u00f3n de datos, p\u00e9rdida de datos debido a una falta de verificaci\u00f3n de capacidad en m\u00faltiples funciones en todas las versiones hasta la 2.7.0 inclusive. Esto hace posible que atacantes no autenticados agreguen, modifiquen o eliminen datos."}], "lastModified": "2025-01-24T17:58:19.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "F6D02936-81CB-45D8-A594-B5D9A2731936", "versionEndExcluding": "2.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}