Tutor LMS – Migration Tool <= 2.2.2 - Missing Authorization in tutor_import_from_xml

Description

The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_from_xml function in all versions up to, and including, 2.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to import courses.