CVE-2024-4351: high-severity vulnerability in themeum Tutor LMS Pro
Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 8.8epss 1.0%
from disclosure to weapon
Published on NVDMay 16
VulnCheckMay 16
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
themeum · Tutor LMS ProRelated CVEs — themeum Tutor LMS Pro
In the same product, most dangerous first.
CVE-2024-4352HIGHTutor LMS Pro <= 2.7.0 - Missing Authorization to SQL InjectionEPSS 1.2%CVE-2026-0953CRITICALTutor LMS Pro <= 3.9.5 - Authentication Bypass via Social LoginEPSS 0.7%CVE-2025-6184HIGHTutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL InjectionEPSS 0.4%CVE-2024-5784HIGHTutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object ReferenceEPSS 0.4%CVE-2024-4222HIGHTutor LMS Pro <= 2.7.0 - Missing AuthorizationEPSS 0.3%CVE-2025-6639MEDIUMTutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other AssignmentsEPSS 0.2%