Threats tagged 'ghsa-c873-m8w7-q26f'

The Tutor LMS WordPress plugin up to version 4.1.2 contains an Insecure Direct Object Reference (IDOR) vulnerability in the init_routes function. Authenticated users with subscriber-level access or higher who possess a valid Tutor LMS API key/secret can exploit this flaw to access paid course content without enrollment, retrieve quiz answer keys, and enumerate sensitive user information including email addresses, usernames, and registration data of instructors and administrators.