CVE-2020-8615 EXPLOIT
6.5
MEDIUM · CVSS 3.1 · EPSS 10.7% (pctl 96)
Patch early
A public exploit exists.
Description
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Scoring
| CVSS | 6.5 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| EPSS | 10.72% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-02-04 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| themeum | tutor lms |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User) | 2020-03-02 |
References
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/
- http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html
- https://wpvulndb.com/vulnerabilities/10058
- https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/
- https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/
- https://www.themeum.com/tutor-lms-updated-v1-5-3/
→ the Explorer · watch your stack · NVD