CVE-2024-4279 allows unauthorized course deletion in the Tutor LMS WordPress plugin. Authenticated instructors can delete arbitrary courses due to insecure direct object reference. This vulnerability affects versions up to 2.7.0.

The Tutor LMS plugin, a popular eLearning solution for WordPress, is susceptible to this insecure direct object reference (IDOR) vulnerability. Although the CVSS score is 6.5, indicating a medium severity, the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a lower immediate risk compared to vulnerabilities with SVRS scores above 80. However, successful exploitation can lead to significant data loss and disruption of online learning platforms. The vulnerability stems from missing validation on a user-controlled key within the 'tutor_course_delete' function, which can allow attackers with Instructor-level permissions or higher to delete any course. It is crucial for administrators to update to a patched version of the Tutor LMS plugin to mitigate this risk and prevent unauthorized course deletions. The fact that this vulnerability has been tagged as "In The Wild" also raises concerns.