CVE-2024-10393
EUVD-2024-3341721.11.2024, 11:15
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| themeum | tutor_lms | 𝑥 ≤ 2.7.6 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| themeum | tutor_lms | 𝑥 ≤ 2.7.6 | ADP |
Common Weakness Enumeration