2024-11-21 06:49:54
Wordfence
PUBLISHED
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the users_can_register option in the register_instructor function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.