CVE-2024-4222 is a missing authorization vulnerability (CWE-862) in the Tutor LMS Pro WordPress plugin (versions up to and including 2.7.0). The plugin fails to perform proper capability checks on multiple functions, enabling unauthenticated attackers to manipulate user meta data and plugin options. This can result in unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The CVSS 3.1 base score is 7.3, reflecting the potential confidentiality, integrity, and availability impacts.

Successful exploitation allows unauthenticated attackers to add, modify, or delete user meta and plugin options, potentially leading to unauthorized access to sensitive data, data integrity compromise, and data loss within the affected WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid using affected versions in production environments if possible.