CVE-2024-3553 Overview
CVE-2024-3553 affects the Tutor LMS eLearning and online course solution plugin for WordPress. The vulnerability results from a missing capability check on the hide_notices function in all versions up to and including 2.6.2. Unauthenticated attackers can invoke this function to modify plugin settings without proper authorization. The most notable impact is the ability to enable user registration on sites where administrators have deliberately disabled it. The flaw is classified under [CWE-862] Missing Authorization. Themeum addressed the issue in Tutor LMS version 2.7.0.
Critical Impact
Unauthenticated attackers can toggle WordPress site settings, including enabling open user registration on sites where it was disabled, creating a foothold for further account-based abuse.
Affected Products
- Themeum Tutor LMS plugin for WordPress, all versions up to and including 2.6.2
- WordPress sites with the Tutor LMS eLearning solution installed
- Sites relying on Tutor LMS to control front-end user registration settings
Discovery Timeline
- 2024-05-02 - CVE-2024-3553 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-3553
Vulnerability Analysis
The vulnerability exists in the hide_notices function within the classes/User.php file of the Tutor LMS plugin. The function is intended to dismiss administrative notices but does not verify whether the caller holds the required WordPress capabilities. Because the function is exposed through a request handler reachable without authentication, any remote attacker can invoke it. In addition to dismissing notices, the handler updates plugin option values that control site behavior, including the flag governing WordPress user registration. An attacker who enables registration on a hardened site gains an anonymous pathway to create accounts, which can be chained with other plugin flaws or used for spam and abuse.
Root Cause
The root cause is the absence of a current_user_can() capability check and a nonce validation inside the hide_notices handler. WordPress plugins are expected to gate administrative state changes behind both capability checks and nonce verification. Neither control is present in vulnerable versions of Tutor LMS.
Attack Vector
Exploitation occurs over the network against the WordPress site's HTTP endpoint. No authentication, user interaction, or elevated privileges are required. An attacker sends a crafted request that triggers the hide_notices handler, which then writes attacker-influenced values into WordPress options. The confidentiality and integrity impact are limited, and availability is not affected.
No public exploit proof-of-concept is listed for this CVE, and it is not tracked in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is documented in the Wordfence Vulnerability Report and the Tutor LMS 2.7.0 changeset.
Detection Methods for CVE-2024-3553
Indicators of Compromise
- Unexpected changes to the WordPress users_can_register option value in the wp_options table.
- Creation of new WordPress user accounts on sites that previously disabled self-registration.
- HTTP requests to the Tutor LMS AJAX endpoint invoking the hide_notices action from unauthenticated sessions.
- Plugin-related option updates recorded outside of administrator login sessions.
Detection Strategies
- Audit the wp_options table for the current value of users_can_register and compare it against the intended configuration baseline.
- Review web server access logs for POST requests to admin-ajax.php referencing the hide_notices action without an authenticated session cookie.
- Correlate plugin option changes with the absence of a corresponding administrator login event.
Monitoring Recommendations
- Alert on any modification to the users_can_register WordPress option in production environments.
- Monitor new user account creation rates and flag unexpected spikes following plugin activity.
- Track installed Tutor LMS versions across managed sites and flag instances at or below version 2.6.2.
How to Mitigate CVE-2024-3553
Immediate Actions Required
- Upgrade Tutor LMS to version 2.7.0 or later on every affected WordPress installation.
- Verify the users_can_register setting under WordPress General Settings and reset it to the intended value if it was altered.
- Review the WordPress users list and remove any unauthorized accounts created while registration was unexpectedly enabled.
- Rotate credentials for any accounts that may have been provisioned during the exposure window.
Patch Information
Themeum released the fix in Tutor LMS version 2.7.0. The patch adds authorization enforcement to the hide_notices handler in classes/User.php. Refer to the WordPress Tutor Plugin Update changeset for the exact code change applied by the vendor.
Workarounds
- Deactivate the Tutor LMS plugin until the site can be updated to version 2.7.0 or later.
- Restrict access to wp-admin/admin-ajax.php at the web application firewall (WAF) layer for unauthenticated hide_notices action requests.
- Enforce the desired users_can_register value through a must-use plugin or wp-config.php filter to override runtime tampering.
# Configuration example: enforce disabled registration via wp-cli
wp option update users_can_register 0
wp plugin update tutor --version=2.7.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.