CVE-2023-3133 Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

2023-07-0407:23:24

WPScan

www.cve.org

cve-2023-3133

tutor lms

unauthenticated access

lesson resources

rest api

wordpress plugin

0.001 Low

EPSS

Percentile

42.3%

JSON

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Tutor LMS",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.2.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]