CVE-2024-5784 is a missing authorization vulnerability in the Tutor LMS Pro WordPress plugin (up to version 2.7.2). The plugin fails to enforce proper capability checks on several administrative functions, allowing authenticated users with low privileges (subscriber-level and above) to execute administrative actions such as deleting content and managing users. This vulnerability is categorized under CWE-862 and has a CVSS 3.1 base score of 7.1 (high severity), reflecting low attack complexity and the potential for high impact on integrity. No patch or official fix has been documented yet, and the plugin is not a cloud service, so remediation depends on vendor updates or manual mitigation.

An attacker with subscriber-level access can perform unauthorized administrative actions on the affected WordPress site, including deleting comments, posts, or users, and viewing notifications. This compromises the integrity of site content and user management functions. The confidentiality impact is low, integrity impact is high, and availability is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to administrative actions. Avoid granting unnecessary privileges to low-level users. Follow updates from the vendor for an official patch or temporary workaround.