High severity7.5NVD Advisory· Published Jul 4, 2023· Updated Jun 17, 2026

CVE-2023-3133

Description

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Themeum/Tutor Lms
cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*
Range: <2.2.1
WordPress/Tutorcpe-rescue
Package: https://wordpress.org/plugins/tutor
WordPress/Tutor Lmsllm-fuzzy
Range: <2.2.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5nvdExploitThird Party Advisory
plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.phpnvdProduct
wordpress.org/plugins/tutor/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000