Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)

Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. PoC As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...

CVE-2020-8615: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions such as blocking legitimate instructors...

PT-2020-20238

Name of the Vulnerable Software and Affected Versions Tutor LMS plugin versions prior to 1.5.3 Description A CSRF issue can result in an attacker approving themselves as an instructor and performing other malicious actions, such as blocking legitimate instructors. Recommendations For versions pri...