Tutor LMS Missing Authorization Vulnerability Allows Attachment Deletion

A vulnerability exists in the Tutor LMS WordPress plugin, specifically in versions up to and including 3.9.4. The issue arises from a lack of proper capability checks in the 'delete_existing_user_photo' function, allowing authenticated users with subscriber-level access and above to delete arbitrary attachments from the site.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of attachments, potentially causing loss of important data or disrupting the site's content management.

Remediation

Users are advised to update the Tutor LMS plugin to version 3.9.5 or a newer patched version.