Medium severity4.3NVD Advisory· Published Nov 15, 2024· Updated Jun 17, 2026
CVE-2024-10897
CVE-2024-10897
Description
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<=2.1.5+ 1 more
- (no CPE)range: <=2.1.5
- (no CPE)
cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:*range: <2.1.6
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/3186320/tutor-lms-elementor-addons/trunk/classes/Installer.phpnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/99edd858-5e2c-4cc5-adda-d8e70ddc86f6nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/trunk/classes/Installer.phpnvdProduct
News mentions
0No linked articles in our index yet.