The Tutor LMS Pro plugin for WordPress contains an authentication bypass vulnerability (CWE-287) in all versions up to 3.9.5 through its Social Login addon. The vulnerability occurs because the plugin fails to confirm that the email address provided during authentication matches the email associated with the validated OAuth token. Consequently, an attacker can supply a valid OAuth token from their own account but specify a victim's email address, enabling unauthorized login as that victim, including users with administrative privileges. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and gain access to any user account, including administrators, on the affected Tutor LMS Pro plugin installations. This can lead to full compromise of the affected WordPress site, including data theft, modification, or deletion, and potential further attacks leveraging administrative access.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's official advisory channels for updates. Until a patch is released, consider disabling the Social Login addon or restricting its use to trusted users only to reduce exposure.