CVE-2024-5784 Overview
The Tutor LMS Pro plugin for WordPress contains a missing authorization vulnerability [CWE-862] affecting all versions up to and including 2.7.2. Multiple AJAX handlers, including treport_quiz_atttempt_delete and tutor_gc_class_action, lack capability checks. Authenticated users with subscriber-level access or higher can invoke these functions to perform administrative actions. Exploitation allows attackers to delete comments, posts, and users, or view notifications intended for administrators. The flaw impacts the integrity of any WordPress site running a vulnerable release of the plugin.
Critical Impact
Any authenticated user, including low-privileged subscribers, can execute administrator-only actions such as deleting posts, comments, and users on affected WordPress sites.
Affected Products
- Themeum Tutor LMS Pro for WordPress, all versions up to and including 2.7.2
- WordPress sites exposing subscriber-level registration with the vulnerable plugin active
- Deployments using the pro edition matching CPE cpe:2.3:a:themeum:tutor_lms:*:*:*:*:pro:wordpress:*:*
Discovery Timeline
- 2024-08-30 - CVE-2024-5784 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5784
Vulnerability Analysis
The vulnerability stems from the absence of capability checks in multiple AJAX endpoints registered by the Tutor LMS Pro plugin. WordPress requires plugins to gate privileged actions through current_user_can() calls that verify the acting user holds the required capability. In vulnerable Tutor LMS Pro builds, functions such as treport_quiz_atttempt_delete and tutor_gc_class_action register handlers accessible to any authenticated user via wp_ajax_ hooks without validating their role.
An attacker with a subscriber account, the lowest authenticated role in WordPress, can invoke these endpoints directly. The affected functions execute administrative operations, including record deletion and privileged data reads, on behalf of the caller. Since WordPress sites often allow open user registration for learners in an LMS context, the barrier to exploitation is low.
The classification aligns with the CWE-862 pattern of missing authorization checks in server-side handlers that were intended for administrators only.
Root Cause
The plugin registers privileged AJAX callbacks without invoking capability verification or nonce-scoped role checks. Handler code proceeds to database mutation operations under the assumption that only administrators can reach them, when in fact WordPress exposes wp_ajax_{action} endpoints to any logged-in user by default.
Attack Vector
Exploitation is performed remotely over the network by an authenticated user. The attacker sends an HTTP POST request to /wp-admin/admin-ajax.php specifying the vulnerable action name and required parameters. The plugin processes the request as if it originated from an administrator. No user interaction from a victim is required, and attack complexity is low.
The vulnerability does not permit code execution but supports destructive data operations that damage site integrity, such as removing users, posts, or comments.
Detection Methods for CVE-2024-5784
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=treport_quiz_atttempt_delete or action=tutor_gc_class_action originating from subscriber accounts
- Unexpected deletion of WordPress users, posts, or comments not attributable to administrator sessions
- AJAX activity referencing Tutor LMS Pro action names from IPs previously associated only with learner logins
Detection Strategies
- Inspect WordPress access logs for admin-ajax.php requests carrying Tutor LMS Pro action parameters from low-privilege sessions
- Correlate deletion events in the wp_users, wp_posts, and wp_comments tables against the acting user role at the request time
- Deploy a WordPress security plugin or Web Application Firewall (WAF) ruleset that flags known-vulnerable Tutor LMS Pro action names
Monitoring Recommendations
- Enable audit logging of administrative operations, including user and content deletion, with actor role recorded
- Alert on any subscriber-role account triggering AJAX actions that modify site content or user records
- Track the installed version of Tutor LMS Pro across all managed WordPress sites and alert on versions at or below 2.7.2
How to Mitigate CVE-2024-5784
Immediate Actions Required
- Update Tutor LMS Pro to a release later than 2.7.2 as published in the Tutor LMS Release Notes
- Audit WordPress user accounts and remove unrecognized subscriber registrations created before the patch was applied
- Review recent deletions of users, posts, and comments to determine whether unauthorized changes occurred
Patch Information
Themeum addressed the missing capability checks in Tutor LMS Pro versions released after 2.7.2. Refer to the Tutor LMS Release Notes and the Wordfence Vulnerability Report for confirmation of the fixed version and affected handler inventory.
Workarounds
- Disable Tutor LMS Pro until the plugin is updated if patching cannot be scheduled immediately
- Restrict new user registration on affected WordPress sites to reduce the population of accounts capable of exploitation
- Apply WAF rules that block unauthenticated or subscriber-level POST requests to admin-ajax.php containing the vulnerable action names
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
