Read the docs
TI-2024-10101 Aliases CVE-2024-10897GHSA-82g8-54mp-r3ww

Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
themeumTutor LMS Elementor Addonsup to 2.1.5—No fix listedCNA
  • Tutor LMS Elementor Addons Vendorthemeum Affected up to 2.1.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:*before 2.1.6Vulnerablethemeum
  • cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:* Versions before 2.1.6 Vulnerable ·themeum

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10897
  2. 2026-10-03 Alias added: GHSA-82g8-54mp-r3ww

References

Patch 1

Advisory 1

Other 1

  • TI-2024-36014 WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-19680 WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2024-05180 Cross-site scripting in themeum Tutor LMS Elementor Addons CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences