CVE-2020-8615

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://wpvulndb.com/vulnerabilities/10058Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/Third Party Advisory
https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/Third Party Advisory
https://www.themeum.com/tutor-lms-updated-v1-5-3/Release Notes, Vendor Advisory
http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://wpvulndb.com/vulnerabilities/10058Third Party Advisory
https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/Third Party Advisory
https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/Third Party Advisory
https://www.themeum.com/tutor-lms-updated-v1-5-3/Release Notes, Vendor Advisory

Timeline

Published: Feb 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-86168.6A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals CVE-2020-86175.9Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or CVE-2020-86184.9An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure CVE-2020-86194.9In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9 CVE-2020-86207.5In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection CVE-2020-86217.5In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who CVE-2020-86226.5In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, A CVE-2020-86237.5In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition,CVE-2020-86244.3In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11 CVE-2020-86258.1BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which us CVE-2020-86315.5cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because CVE-2020-86325.5In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easie