Description
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| themeum | Tutor LMS – eLearning and online course solution | ≤ 2.7.6 | — |