This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Tutor LMS Pro has a critical **Authorization Flaw**. ๐ **Consequences**: Attackers can bypass authentication and impersonate **any existing user**.โฆ
๐ก๏ธ **Root Cause**: **CWE-287** (Improper Authentication). The plugin fails to verify if the **email** in the request matches the **email** in the validated OAuth token. ๐ซ Logic gap in identity validation.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: **Tutor LMS Pro** by **Themeum**. ๐ **Version**: 3.9.5 and **earlier** versions. โ ๏ธ If you are running < 3.9.6, you are vulnerable.
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: Login as **ANY** user. ๐ **Impact**: High Confidentiality, Integrity, and Availability loss. Hackers can access private course data, modify user profiles, and disrupt learning environments.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **LOW**. ๐ **CVSS**: 9.8 (Critical). No authentication (PR:N), no user interaction (UI:N), network accessible (AV:N). It is an **easy win** for automated bots.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exp?**: No specific PoC code provided in data. ๐ **Status**: High risk of wild exploitation due to low barrier. WordFence has issued a threat intel alert, signaling active monitoring.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for **Tutor LMS Pro** plugin. โ **Verify Version**: Ensure it is **not** 3.9.5 or older. ๐ ๏ธ Check OAuth token handling logic if custom development is involved.
Q8Is it fixed officially? (Patch/Mitigation)
๐ง **Fix**: Update to the latest version immediately. ๐ข **Reference**: Themeum released a fix (see tutorlms.com/releases/id/393/). ๐ **Action**: Upgrade past 3.9.5 to patch the email mismatch flaw.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Disable the plugin temporarily. ๐ซ **Block**: Restrict access to OAuth endpoints via WAF. ๐ฎ **Monitor**: Alert on unusual login patterns or email mismatches in logs.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **CRITICAL**. โณ **Priority**: Patch **IMMEDIATELY**. CVSS 9.8 means this is a top-tier emergency. Do not wait. Protect user data and site integrity now.