CVE-2024-10897
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Nov 15, 2024
CWE ID 862
Summary
CVE-2024-10897 is a vulnerability affecting the Tutor LMS Elementor Addons plugin for WordPress. This issue stems from a missing capability check on the install_etlms_dependency_plugin() function, allowing authenticated attackers with Subscriber-level access and above to install Elementor or Tutor LMS unauthorizedly. Despite the limited impact due to the common installation of these plugins as dependencies, it is crucial for users to update the plugin to the latest version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.