The vulnerability allows an attacker to circumvent authentication by providing a valid OAuth token from their own account together with any victim’s email address. The plugin does not verify that the email in the request matches the email returned by the OAuth provider, so unauthenticated users can log in as any existing user, including administrators. This flaw results in full impersonation and unauthorized control over the WordPress site. The weak point is an authentication validation weakness (CWE-287).

WordPress sites that use the Tutor LMS Pro plugin version 3.9.5 or earlier, including those with the Social Login addon enabled. The affected vendor is Themeum for Tutor LMS Pro. No additional version details are supplied beyond the <= 3.9.5 range.

The CVSS base score is 9.8, indicating critical severity, while the EPSS score is less than 1%, suggesting that widespread exploitation is not currently observed but the vulnerability remains potent. The flaw is not listed in the CISA KEV catalog, but because it grants full administrative access with minimal prerequisites—a valid OAuth token and any email address—it poses a high risk wherever the plugin is installed. The likely attack vector is through the Social Login integration, where an attacker can submit crafted authentication requests to the plugin’s OAuth endpoint to obtain a session as any user.