Security Advisory
CVE-2024-10393
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the users_can_register option in the register_instructor function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.