CVE-2024-10897: Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
First published: Fri Nov 15 2024(Updated: )
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tutor LMS | <2.1.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/99edd858-5e2c-4cc5-adda-d8e70ddc86f6?source=cve
- https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/trunk/classes/Installer.php#L152
- https://plugins.trac.wordpress.org/changeset/3186320/tutor-lms-elementor-addons/trunk/classes/Installer.php
Frequently Asked Questions
What is the severity of CVE-2024-10897?
CVE-2024-10897 has a high severity due to the potential for unauthorized plugin installations by authenticated attackers.
How do I fix CVE-2024-10897?
To fix CVE-2024-10897, update the Tutor LMS Elementor Addons plugin to version 2.1.6 or later.
Which versions are affected by CVE-2024-10897?
CVE-2024-10897 affects all versions of the Tutor LMS Elementor Addons plugin up to and including 2.1.5.
What is the nature of the vulnerability in CVE-2024-10897?
The vulnerability in CVE-2024-10897 is due to a missing capability check on the install_etlms_dependency_plugin() function.
Who can exploit CVE-2024-10897?
CVE-2024-10897 can be exploited by authenticated attackers who can leverage the lack of capability checks.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/themeum
- canonical/tutor lms