Themeum Tutor LMS Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the Themeum Tutor LMS plugin, affecting versions through 3.9.4. This issue arises from incorrectly configured access control security levels, which could be exploited to bypass authorization and access sensitive files or database information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or database interactions, allowing for potential data manipulation or exposure.

Remediation

Users of the Tutor LMS WordPress plugin should update to version 3.9.5 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.