CVE-2024-1133 allows unauthorized access to restricted Q&A content in the Tutor LMS WordPress plugin. This vulnerability affects versions up to 2.6.0, enabling authenticated attackers with subscriber access or higher to interact with questions in courses they are not enrolled in, even private courses. The flaw stems from a missing capability check when handling questions.

While CVE-2024-1133 has a relatively low SOCRadar Vulnerability Risk Score (SVRS) of 30, indicating it's not considered a critical vulnerability requiring immediate action, the unauthorized access to course content is still a significant concern. Successful exploitation could lead to data leakage and compromise the integrity of the eLearning platform. Although the CVSS score is 0, indicating no base severity, this is likely because it requires authentication and is not remotely exploitable, but the impact is still important for course creators to evaluate. Organizations using the Tutor LMS plugin should update to a patched version to mitigate the security risk.