EUVD-2026-46167
GHSA-4v6x-453r-gmgq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible WordPress endpoint requires low-privilege authenticated session; impact is limited to unauthorized plugin activation with no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activate_tutor_free() and activate_elementor_free() functions registered as admin_action_* handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
AnalysisAI
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Technical ContextAI
The affected plugin (CPE: cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:*:*:*) registers two functions - activate_tutor_free() and activate_elementor_free() - as WordPress admin_action_* hook handlers, as shown in the plugin's classes/Installer.php (lines 213, 222, and 29 visible in the 3.0.1 source on WordPress Trac). The admin_action_* hook fires for any authenticated request matching the action parameter, but the functions omit the required current_user_can() capability check before performing privileged operations. CWE-862 (Missing Authorization) captures this root cause: the code identifies the caller but never verifies whether that caller holds the right to perform plugin activation, a function normally restricted to administrators. This pattern is a common WordPress-specific authorization pitfall when developers rely on authentication (is the user logged in?) without enforcing authorization (does this user role permit this action?).
RemediationAI
Update the Tutor LMS Elementor Addons plugin to a version beyond 4.0.0; the exact patched release version is not independently confirmed from the provided data - verify the current version in the WordPress Plugin Directory or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8a276a3e-12c3-4af7-9eb8-a25d20563de7 before deploying. WordPress Plugin Trac changesets between tags 3.0.1→3.0.2 and 3.0.2→4.0.0 are referenced but 4.0.0 remains vulnerable, indicating the fix lands in a later release. As a compensating control prior to patching, restrict Subscriber-level and above registration to trusted users only, and consider disabling open user registration on sites where it is not operationally required - this limits the attacker pool to existing account holders and reduces exploitability without impacting core site functionality.
More in Tutor Lms Elementor Addons
View allImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carouse
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.1.5. Rated medium s
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing c
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today