CVE-2024-3553 Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update

What is CVE-2024-3553?

CVE-2024-3553 is a medium-severity missing authorization vulnerability in themeum Tutor LMS – eLearning and online course solution, published on 2 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.

Weakness: CWE-862

Which versions are affected by CVE-2024-3553?

It affects 1 product.

Products include Themeum Tutor Lms.

How do I fix CVE-2024-3553?

No fix has been published for CVE-2024-3553 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-3553 being exploited?

There is no known exploitation of CVE-2024-3553 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in themeum Tutor LMS – eLearning and online course solution

• CVE-2024-4223 Tutor LMS <= 2.7.0 - Missing Authorization Critical 9.8
• CVE-2024-4318 Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection High 8.8
• CVE-2024-4351 Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation High 8.8
• CVE-2024-4352 Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection High 8.8
• CVE-2024-1751 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-576v-pqr8-c2mq.