CVE-2024-4351 Overview
CVE-2024-4351 affects the Tutor LMS Pro plugin for WordPress, developed by Themeum. The vulnerability stems from a missing capability check on the authenticate function in all versions up to and including 2.7.0. Authenticated attackers with subscriber-level permissions or higher can gain control of an existing administrator account. This results in unauthorized data access, data modification, and data loss across affected WordPress installations.
Critical Impact
Any authenticated user, including low-privilege subscribers, can escalate privileges and take over administrator accounts on WordPress sites running Tutor LMS Pro through version 2.7.0.
Affected Products
- Themeum Tutor LMS Pro for WordPress (all versions up to and including 2.7.0)
- WordPress sites with the pro edition of the plugin installed
- Deployments matching CPE cpe:2.3:a:themeum:tutor_lms:*:*:*:*:pro:wordpress:*:*
Discovery Timeline
- 2024-05-16 - CVE-2024-4351 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-4351
Vulnerability Analysis
The flaw resides in the plugin's authenticate function, which handles session establishment for users interacting with Tutor LMS Pro. The function does not verify that the calling user has the appropriate capability before authenticating as another account. As a result, an attacker with a valid low-privileged session can invoke the function to authenticate as an administrator. The vulnerability maps to CWE-862: Missing Authorization and CWE-89: SQL Injection, reflecting both the broken access control and an underlying query composition weakness.
Root Cause
The root cause is a missing capability check inside a privileged plugin action. WordPress plugins are expected to gate sensitive functions using current_user_can() or nonce-based authorization. The authenticate function in Tutor LMS Pro exposes account switching logic without such a check, allowing any authenticated request to reach the code path.
Attack Vector
The attack is network-based and requires only subscriber-level access. Subscriber accounts can be created on WordPress sites that enable open registration, including many learning management deployments. Once authenticated, the attacker sends a crafted request to the plugin endpoint that invokes the vulnerable function. The response grants the attacker an administrator session, enabling full site takeover, plugin installation, and content manipulation.
No public proof-of-concept exploit is available at the time of writing. Technical detail is documented in the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-4351
Indicators of Compromise
- Unexpected administrator role assignments in the wp_usermeta table shortly after subscriber account activity.
- New administrator accounts, plugin installations, or theme uploads originating from IPs previously tied to low-privileged sessions.
- Access log entries showing subscriber-authenticated requests to Tutor LMS Pro AJAX or REST endpoints followed by admin-only actions.
Detection Strategies
- Inventory WordPress installations and identify sites running Tutor LMS Pro at version 2.7.0 or earlier.
- Audit WordPress user role change events and correlate them with the originating session's baseline privilege.
- Review web server logs for repeated requests to Tutor LMS authentication endpoints from the same low-privileged user.
Monitoring Recommendations
- Alert on any privilege elevation to administrator that is not initiated by an existing administrator session.
- Monitor for creation of new admin users, changes to wp-config.php, and installation of unknown plugins.
- Forward WordPress and web server logs to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2024-4351
Immediate Actions Required
- Update Tutor LMS Pro to a version later than 2.7.0 that includes the capability check fix.
- Rotate credentials for all administrator accounts on affected sites and enforce multi-factor authentication.
- Review user lists for unauthorized administrator accounts and remove any that cannot be attributed to a legitimate action.
Patch Information
Themeum addressed the missing capability check in a release following 2.7.0. Refer to the vendor product page at Themeum Tutor LMS for the current release and changelog. The Wordfence Vulnerability Report tracks fixed version details.
Workarounds
- Disable open user registration on WordPress sites running Tutor LMS Pro until patched.
- Restrict access to the WordPress admin and AJAX endpoints using a web application firewall rule that blocks calls to the vulnerable authenticate action.
- Temporarily deactivate the Tutor LMS Pro plugin on high-value sites if a patched version cannot be deployed immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
