CVE-2024-10393: Themeum Tutor Lms

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.

Affected products

• Themeum Tutor Lms: up to and including 2.7.6

Published 2024-11-21. Last modified 2026-06-17.