CVE-2024-1503 is a CSRF vulnerability in the Tutor LMS WordPress plugin (up to version 2.6.1) caused by missing or incorrect nonce validation on the erase_tutor_data() function. This flaw allows an attacker to send a forged request that, if executed by an administrator, can deactivate the plugin and erase all stored data, contingent on the "Erase upon uninstallation" setting being enabled. The attack requires user interaction (UI:R) but no privileges or authentication (PR:N). The vulnerability impacts the integrity of the plugin's data but does not affect confidentiality or availability directly.

An attacker can cause loss of data and disable the Tutor LMS plugin by exploiting this CSRF vulnerability, but only if the targeted administrator interacts with a malicious link and the "Erase upon uninstallation" option is enabled. There is no impact on confidentiality or availability beyond the data erasure and plugin deactivation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling the "Erase upon uninstallation" option if feasible and avoid clicking on untrusted links while logged in as an administrator. Monitoring for updates from the vendor is recommended to apply an official fix once released.