CVE-2024-4352: 
WordPress vulnerability analysis and mitigation

The Tutor LMS Pro plugin for WordPress (versions up to 2.7.1) contains a vulnerability identified as CVE-2024-4352. The vulnerability was discovered and disclosed on May 16, 2024, affecting the 'get_calendar_materials' function. This security issue impacts the plugin's data handling capabilities and affects WordPress installations using the Tutor LMS Pro plugin (NVD).

The vulnerability stems from two primary issues: a missing capability check in the 'get_calendar_materials' function and an SQL Injection vulnerability via the 'year' parameter. The SQL Injection is caused by insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to unauthorized access to data, modification of data, and potential loss of data. Authenticated attackers with subscriber-level permissions or higher can exploit this vulnerability to append additional SQL queries to existing queries, potentially extracting sensitive information from the database (NVD).

The vulnerability can be exploited by authenticated users with subscriber-level permissions or higher. The attack requires low attack complexity and no user interaction, making it relatively straightforward to exploit for authenticated users (NVD).

The vulnerability has been fixed in version 2.7.1 of the Tutor LMS Pro plugin. Users are advised to update to this version or later to protect against potential exploitation (NVD).