VulnerabilityModified
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
MEDIUM 6.5EPSS 8.83%
Does this matter?
Lower severity and a low EPSS score (8.83%). Track it; it rarely justifies an emergency change on its own.
Description
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 8.83% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- themeum/tutor lms
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
- https://wpvulndb.com/vulnerabilities/10058Third Party Advisory
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/Third Party Advisory
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/Third Party Advisory
- https://www.themeum.com/tutor-lms-updated-v1-5-3/Release Notes, Vendor Advisory
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
- https://wpvulndb.com/vulnerabilities/10058Third Party Advisory
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/Third Party Advisory
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/Third Party Advisory
- https://www.themeum.com/tutor-lms-updated-v1-5-3/Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.