CVE-2024-1804
📋 TL;DR
The Tutor LMS Migration Tool WordPress plugin has an authorization bypass vulnerability that allows authenticated users with subscriber-level access or higher to import courses without proper permission checks. This affects all versions up to and including 2.2.0. Attackers can misuse this to add unauthorized content to WordPress sites.
💻 Affected Systems
- Tutor LMS - Migration Tool WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could import malicious courses containing scripts or inappropriate content, potentially compromising site integrity or enabling further attacks through uploaded content.
Likely Case
Unauthorized users import courses they shouldn't have access to, disrupting legitimate course management and potentially exposing sensitive educational materials.
If Mitigated
With proper user role management and monitoring, impact is limited to unauthorized course imports that can be detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is publicly documented with code references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.2.0
Vendor Advisory: https://plugins.trac.wordpress.org/browser/tutor-lms-migration-tool/trunk/classes/LPtoTutorMigration.php
Restart Required: No
Instructions:
1. Update the Tutor LMS Migration Tool plugin to the latest version via WordPress admin panel. 2. Verify the update completed successfully. 3. Test course import functionality with appropriate user roles.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate tutor-lms-migration-tool
Restrict User Roles
allLimit user accounts with subscriber-level access or review existing accounts
🧯 If You Can't Patch
- Implement strict user role management and audit all subscriber-level accounts
- Monitor course import logs and implement alerts for unauthorized import attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for Tutor LMS Migration Tool plugin version. If version is 2.2.0 or lower, the system is vulnerable.Check Version:
wp plugin get tutor-lms-migration-tool --field=versionVerify Fix Applied:
Verify plugin version is higher than 2.2.0 and test that subscriber-level users cannot import courses.📡 Detection & Monitoring
Log Indicators:
- Unexpected course import events from non-admin users
- Multiple import attempts from single user accounts
Network Indicators:
- POST requests to tutor_import_from_xml endpoint from unauthorized user roles
SIEM Query:
source="wordpress" AND (event="course_import" OR action="tutor_import") AND user_role="subscriber"🔗 References
- https://plugins.trac.wordpress.org/browser/tutor-lms-migration-tool/trunk/classes/LPtoTutorMigration.php#L579
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49a22e-d54e-461d-83c2-8278494eac13?source=cve
- https://plugins.trac.wordpress.org/browser/tutor-lms-migration-tool/trunk/classes/LPtoTutorMigration.php#L579
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49a22e-d54e-461d-83c2-8278494eac13?source=cve
