The Tutor LMS Elementor Addons plugin for WordPress suffers from a missing capability check in the install_etlms_dependency_plugin() function in all versions up to 2.1.5. This missing authorization allows authenticated users with low privileges (Subscriber and above) to install additional plugins, specifically Elementor or Tutor LMS. However, the practical impact is limited since these plugins are usually pre-installed as dependencies of the addon. The vulnerability is tracked as CVE-2024-10897 with a CVSS 3.1 base score of 4.3 (medium severity). No patch or remediation details are currently available.

An attacker with Subscriber-level access or higher can install plugins without proper authorization, potentially leading to unauthorized plugin installations. However, since the targeted plugins (Elementor and Tutor LMS) are likely already installed, the real-world impact is limited. There is no indication of confidentiality or availability impact, only a low integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unauthorized plugin installations. Avoid granting Subscriber-level or higher access to untrusted users.