What’s Vulnerable › Vulnerabilities

CVE-2023-3133: Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-04 · updated 2026-06-17

Description

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

Affected products

• themeum Tutor LMS – eLearning and online course solution: before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: themeum Tutor LMS – eLearning and online course solution 2.2.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
• https://wordpress.org/plugins/tutor/
• https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5
• https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253
• https://wordpress.org/plugins/tutor/
• https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5

Get alerted when CVE-2023-3133 or the next vulnerability affects your stack