The Tutor LMS Elementor Addons plugin for WordPress contains missing capability checks on the activate_tutor_free() and activate_elementor_free() functions, which are registered as admin_action_* handlers. Because these checks are omitted, any authenticated user with Subscriber role or higher can invoke the activation handlers and enable the Tutor LMS and Elementor plugins without proper authorization. The result is that an unauthenticated attacker gains the ability to install or enable additional plugins, potentially altering site behavior or setting the stage for subsequent attacks. This weakness is classified as CWE‑862: Missing Authorization.

WordPress sites that have the Themeum Tutor LMS Elementor Addons plugin installed, in any version up to and including 4.0.0, regardless of the WordPress core version. The plugin’s vulnerability is present in all such releases, creating a uniform risk across all affected installations.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, while the EPSS score of <1% suggests a very low exploitation probability. The vulnerability is not listed in CISA KEV. Attackers can exploit this flaw by sending an authenticated POST request to the admin area, for example to admin‑ajax.php or admin‑post.php, targeting the missing admin_action_* handlers. Anyone with Subscriber or higher privileges can trigger the activation functions. Because the flaw does not grant arbitrary code execution, its impact is limited to unauthorized plugin activation, but it can be leveraged to install malicious code or alter site configuration, thereby facilitating more serious attacks.