CVE-2020-8615

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

8.83%

Published

Feb 4, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index Exploit-DBWordPress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-352

Affected Products (1)

themeum · tutor_lms (up to 1.5.3)vulnerable

References (10)

http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html

ExploitThird Party AdvisoryVDB Entry

https://wpvulndb.com/vulnerabilities/10058

Third Party Advisory

https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/

Third Party Advisory

https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/

Third Party Advisory

https://www.themeum.com/tutor-lms-updated-v1-5-3/

Release NotesVendor Advisory

http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html

ExploitThird Party AdvisoryVDB Entry

https://wpvulndb.com/vulnerabilities/10058

Third Party Advisory

https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/

Third Party Advisory

https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/

Third Party Advisory

https://www.themeum.com/tutor-lms-updated-v1-5-3/

Release NotesVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs