CVE-2020-8615: A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitim

medium Affects tutor-lms (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2020-02-04; advisory modified 2026-06-17.

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitim

Package: tutor-lms (WordPress plugin) WordPress
Affected versions: <1.5.3
Fixed in: 1.5.3
Severity: medium CVSS 6.5
Exploitation: not on CISA KEV · EPSS 11% (95.8th percentile)
Published: 2020-02-04
Source: nvd

References

CWE-352

NVD record tutor-lms (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-24182 medium The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning same package: tutor-lms (WordPress plugin)
CVE-2021-24183 medium The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and on same package: tutor-lms (WordPress plugin)
CVE-2021-24184 high Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress p same package: tutor-lms (WordPress plugin)
CVE-2023-0236 medium The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key an same package: tutor-lms (WordPress plugin)
CVE-2021-24181 medium The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online cou same package: tutor-lms (WordPress plugin)
CVE-2021-24185 medium The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course soluti same package: tutor-lms (WordPress plugin)