CVE-2020-8615

EPSS 8.8%

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 8.8%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

04 Feb 2020Published on NVD

02 Mar 2020Public PoC

Weaponization speed

26 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.htmlunverified exploitdbwww.exploit-db.com/exploits/48151unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/156585/WordPress-Tutor-LMS-1.5.3-Cross-Site-Request-Forgery.html https://wpvulndb.com/vulnerabilities/10058 https://www.getastra.com/blog/911/plugin-exploit/cross-site-request-forgery-in-tutor-lms-plugin/https://www.jinsonvarghese.com/cross-site-request-forgery-in-tutor-lms/https://www.themeum.com/tutor-lms-updated-v1-5-3/