CVE-2024-1798 is a missing authorization vulnerability in the Tutor LMS – Migration Tool WordPress plugin affecting all versions up to 2.2.0. The issue arises from the lack of a capability check on the tutor_lp_export_xml function, which handles exporting course data. This allows unauthenticated attackers to export course content, including private and password-protected courses, potentially exposing sensitive educational materials. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity) and is classified under CWE-862. No patch or remediation details are currently provided by the vendor, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker without authentication can export course data, including private and password-protected courses, potentially leading to unauthorized disclosure of sensitive educational content. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin or disabling the migration tool functionality to prevent unauthorized data export. Monitor official themeum communications for updates and apply patches promptly once released.