CVE-2024-4351

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89CWE-862

Affected software

VendorProductVersions
themeumTutor LMS Pro<= 2.7.0
themeumtutor_lms<= 2.7.0

References

Timeline

Published
May 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-435117.0Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-435127.5Windows Standards-Based Storage Management Service Denial of Service VulnerabilityCVE-2024-435136.4BitLocker Security Feature Bypass VulnerabilityCVE-2024-435147.8Windows Resilient File System (ReFS) Elevation of Privilege VulnerabilityCVE-2024-435157.5Internet Small Computer Systems Interface (iSCSI) Denial of Service VulnerabilityCVE-2024-435167.8Windows Secure Kernel Mode Elevation of Privilege VulnerabilityCVE-2024-435178.8Microsoft ActiveX Data Objects Remote Code Execution VulnerabilityCVE-2024-435188.8Windows Telephony Server Remote Code Execution VulnerabilityCVE-2024-435198.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2024-43528.8The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capCVE-2024-435205.0Windows Kernel Denial of Service VulnerabilityCVE-2024-435217.5Windows Hyper-V Denial of Service Vulnerability
CVE-2024-4351: High severity, CVSS 8.8 | Vulnix