CVE-2024-10393 Overview
The Tutor LMS plugin for WordPress contains a broken access control flaw that allows unauthenticated attackers to register accounts on sites where registration is disabled. The vulnerability affects all versions up to and including 2.7.6. It stems from a missing users_can_register option check within the register_instructor function. Attackers can invoke the instructor registration endpoint to create accounts with the site's default role, bypassing administrator-configured registration restrictions. The issue is tracked under [CWE-284] Improper Access Control and [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated attackers can create accounts on WordPress sites running vulnerable Tutor LMS versions, even when the WordPress users_can_register option is disabled.
Affected Products
- Themeum Tutor LMS plugin for WordPress
- Versions up to and including 2.7.6
- WordPress sites using Tutor LMS with registration disabled
Discovery Timeline
- 2024-11-21 - CVE-2024-10393 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10393
Vulnerability Analysis
Tutor LMS provides an instructor registration workflow that runs alongside the standard WordPress registration process. The register_instructor function processes account creation requests from unauthenticated visitors who wish to become instructors on the site. This handler creates a WordPress user account and assigns the site's default role.
The function does not consult the WordPress users_can_register option before creating an account. WordPress administrators use this option to disable public registration site-wide. Because the plugin path ignores that setting, an attacker can submit crafted requests to the instructor registration endpoint and obtain a subscriber-level account regardless of the site's registration policy.
The resulting account inherits the default WordPress role, typically Subscriber. While this role has limited privileges, it enables authenticated attack surface, content posting on some configurations, and pivoting to other authenticated vulnerabilities in installed plugins or themes.
Root Cause
The root cause is a missing authorization check inside the register_instructor function. The handler executes account creation logic without evaluating whether the site permits new registrations. Corresponding logic in standard WordPress registration endpoints honors users_can_register and rejects requests when registration is disabled. The plugin's parallel path did not replicate this control, producing a policy bypass.
Attack Vector
Exploitation requires only network access to the target WordPress site. The attacker sends an unauthenticated HTTP request to the Tutor LMS instructor registration endpoint with the required form fields. The plugin processes the request, creates a user, and returns success. No user interaction, existing credentials, or elevated privileges are needed.
Technical details of the vulnerable code path are documented in the Wordfence Vulnerability Report and the fix is visible in the WordPress Tutor Plugin Changeset 3186319.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-10393
Indicators of Compromise
- Unexpected user accounts created in wp_users when the WordPress users_can_register option is set to 0.
- HTTP POST requests to Tutor LMS AJAX or REST endpoints associated with the register_instructor action from unauthenticated sources.
- New Subscriber-role accounts with registration timestamps clustered together or originating from a small set of IP addresses.
Detection Strategies
- Audit the WordPress user table and compare account creation dates against the date registration was disabled. Any accounts created after that date warrant investigation.
- Enable WordPress debug logging or a security plugin that records registration events, and alert on registrations while users_can_register is disabled.
- Review web server access logs for POST requests referencing tutor_action=register_instructor or the plugin's registration endpoints.
Monitoring Recommendations
- Monitor for spikes in user_register action hooks in application logs.
- Track first-login activity from newly created accounts to identify follow-on privilege escalation attempts.
- Correlate new account creation with subsequent plugin or theme endpoint access to surface chained exploitation.
How to Mitigate CVE-2024-10393
Immediate Actions Required
- Update Tutor LMS to version 2.7.7 or later, which introduces the missing users_can_register check.
- Audit existing WordPress users and remove unauthorized accounts created while public registration was disabled.
- Rotate credentials and review roles for any accounts that show signs of automated creation.
Patch Information
Themeum resolved the issue in the changeset published at WordPress Tutor Plugin Changeset 3186319. The fix adds a check for the users_can_register WordPress option before allowing the register_instructor handler to create a new account. Site operators should upgrade through the WordPress plugin manager or WP-CLI.
Workarounds
- Restrict access to Tutor LMS registration endpoints at the web server or WAF layer until the plugin is updated.
- Temporarily deactivate the Tutor LMS plugin on sites that do not require the instructor registration workflow.
- Enforce administrator approval for new accounts using a membership or user-approval plugin so unauthorized registrations remain inactive.
# Update Tutor LMS via WP-CLI
wp plugin update tutor
wp plugin get tutor --field=version
# Verify registration is disabled at the WordPress level
wp option get users_can_register
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
