Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
25Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendepss 1.4%
from disclosure to weapon
Published on NVDApr 5
VulnCheck+646d
exploitation probability
1.4%top 29% of all CVEs
observed exploitation
yesVulnCheck
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Affected products
Unknown · Tutor LMS – eLearning and online course solution