medium6.5Public exploit code
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other ma…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User)2020-03-02 · webapps · php
Impact
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Themeum | Tutor Lms | before 1.5.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/