Login Sign Up

CVE-2023-3133

7.5 HIGH
Authentication Bypass

📋 TL;DR

This vulnerability allows unauthenticated attackers to access private lesson information in Tutor LMS WordPress plugin. WordPress sites using Tutor LMS versions before 2.2.1 are affected. The issue stems from missing permission checks on REST API endpoints.

💻 Affected Systems

Products:
  • Tutor LMS WordPress plugin
Versions: All versions before 2.2.1
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all WordPress installations with vulnerable Tutor LMS plugin versions. No special configuration required.

📦 What is this software?

Tutor Lms by Themeum

View all CVEs affecting Tutor Lms →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Unauthenticated attackers could access all private lesson content including potentially sensitive educational materials, student data, or proprietary course content.

🟠

Likely Case

Attackers can enumerate and access lesson content that should require authentication, potentially exposing private educational materials.

🟢

If Mitigated

With proper access controls and network segmentation, impact is limited to information disclosure of lesson content only.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP requests to REST API endpoints can trigger the vulnerability without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.1

Vendor Advisory: https://wordpress.org/plugins/tutor/

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Tutor LMS plugin
4. Click 'Update Now' if update available
5. If manual update needed, download version 2.2.1+ from WordPress.org
6. Deactivate old plugin, upload new version, activate

🔧 Temporary Workarounds

Disable REST API endpoints

all

Block access to vulnerable Tutor LMS REST API endpoints using web application firewall or .htaccess rules

# Add to .htaccess:
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/tutor/v1/.*$
RewriteRule ^ - [F]

Temporarily disable plugin

linux

Deactivate Tutor LMS plugin until patched

wp plugin deactivate tutor

🧯 If You Can't Patch

  • Implement network-level restrictions to block external access to /wp-json/tutor/v1/ endpoints
  • Deploy web application firewall rules to detect and block unauthorized REST API requests

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Tutor LMS version. If version is below 2.2.1, system is vulnerable.

Check Version:

wp plugin get tutor --field=version

Verify Fix Applied:

After updating to 2.2.1+, attempt to access /wp-json/tutor/v1/lessons endpoint without authentication. Should return 401/403 error.

📡 Detection & Monitoring

Log Indicators:

  • HTTP 200 responses to /wp-json/tutor/v1/lessons from unauthenticated IPs
  • Increased requests to Tutor REST API endpoints

Network Indicators:

  • Unusual traffic patterns to /wp-json/tutor/v1/ endpoints
  • GET requests to lesson endpoints without authentication headers

SIEM Query:

source="web_server" AND uri="/wp-json/tutor/v1/*" AND response_code=200 AND NOT auth_token=*

📊 Metadata

CVE ID: CVE-2023-3133
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: July 4, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON