Input validation vulnerability in Tutor LMS – eLearning and online course solution 2.6.1

The Tutor LMS plugin for WordPress, which helps create online courses, has a security vulnerability in versions up to 2.6.1. This vulnerability, called Cross-Site Request Forgery, happens when the plugin doesn’t properly check for a security code before performing a certain function. This means that someone who is not authorized could deactivate the plugin and delete all the data if they can trick a site administrator into clicking on a link. This can only happen if the “Erase upon uninstallation” option is turned on.