Is CVE-2024-4352 actively exploited?

No active exploitation of CVE-2024-4352 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-4352 be exploited remotely?

Yes. CVE-2024-4352 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-4352?

CVE-2024-4352 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2024-4352

HIGH

CVE-2024-4352

CWE-862Published: May 16, 2024· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'get_calendar_materials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD Source

Technical Analysis

CVE-2024-4352 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.