CVE-2024-10393
📋 TL;DR
The Tutor LMS WordPress plugin vulnerability allows unauthenticated attackers to register user accounts even when site registration is disabled. This affects WordPress sites using Tutor LMS version 2.7.6 or earlier. Attackers can create accounts with default site roles, potentially gaining unauthorized access.
💻 Affected Systems
- Tutor LMS WordPress Plugin
📦 What is this software?
Tutor Lms by Themeum
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, take over the WordPress site, and potentially compromise the entire web server.
Likely Case
Attackers create multiple user accounts to spam the site, access restricted content, or perform limited malicious activities.
If Mitigated
If proper role-based access controls exist, attackers only gain low-privilege accounts with minimal impact.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint with minimal technical knowledge required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.7
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3186319/tutor
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Tutor LMS and click 'Update Now'. 4. Verify version is 2.7.7 or higher.
🔧 Temporary Workarounds
Disable Tutor LMS Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate tutor
Block Registration Endpoint
linuxUse web application firewall or .htaccess to block access to vulnerable endpoint
RewriteEngine On
RewriteRule ^wp-content/plugins/tutor/.*register_instructor - [F,L]
🧯 If You Can't Patch
- Implement rate limiting on registration endpoints
- Enable WordPress user registration approval and monitor new registrations
🔍 How to Verify
Check if Vulnerable:
Check Tutor LMS plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin get tutor --field=versionVerify Fix Applied:
Verify Tutor LMS version is 2.7.7 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual user registration spikes
- Registrations from unexpected IPs
- Multiple registrations with similar usernames
Network Indicators:
- POST requests to /wp-content/plugins/tutor/ endpoints with registration parameters
SIEM Query:
source="wordpress.log" AND ("register_instructor" OR "tutor/registration")