Miembros de
Boletines de Vulnerabilidades |
CVE-2026-0548 |
|
| Software afectado | WORDPRESS |
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-0548 | |
