CVE-2020-8615 EXPLOIT
6.5
MEDIUM · CVSS 3.1 · EPSS 8.8% (pctl 95)
Patch early
A public exploit exists.
Description
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Scoring
| CVSS | 6.5 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| EPSS | 8.83% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-02-04 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| themeum | tutor lms |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User) | 2020-03-02 |
References
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/
→ the Explorer · watch your stack · NVD