CVE-2024-10393 is an improper access control vulnerability (CWE-284) in the Tutor LMS plugin for WordPress, versions up to and including 2.7.6. The issue arises because the 'register_instructor' function fails to verify the 'users_can_register' setting, which normally controls whether user registration is permitted. As a result, unauthenticated attackers can register accounts with the default role despite registration being disabled, potentially leading to unauthorized access or privilege escalation within the LMS environment.

This vulnerability allows unauthenticated attackers to create user accounts on affected installations even when user registration is disabled. While it does not directly impact confidentiality or availability, it compromises integrity by permitting unauthorized users to gain a foothold with default user privileges. This could facilitate further attacks depending on the site's configuration and user role permissions.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting access to the Tutor LMS registration functionality or applying custom code to enforce the 'users_can_register' check. Monitoring for updates from the vendor themeum is recommended to apply an official fix once released.