CVE-2024-4351 describes a critical missing capability check in the 'authenticate' function of the Tutor LMS Pro WordPress plugin, affecting all versions up to and including 2.7.0. This vulnerability allows authenticated attackers, even with subscriber-level permissions, to gain full control over existing administrator accounts. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity, leading to high impact on confidentiality, integrity, and availability. While the EPSS score indicates a higher than average exploitability probability, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in CISA's KEV catalog. Community discussion and media coverage are also minimal, suggesting it is not yet widely known or actively exploited.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.7.1CPE matchmatch criteria | cpe:2.3:a:themeum:tutor_lms:*:*:*:*:pro:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.