CVE-2023-3133
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Risk Assessment
The organization may be exposed to the disclosure of sensitive educational information, potentially leading to user privacy violations.
Recommendation
It is recommended to update the Tutor LMS plugin to version 2.2.1 or later to ensure proper permission checks.
Other vulnerabilities in Tutor LMS WordPress plugin
Original NVD description (English source)
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS