CVE-2026-1372
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0. This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
Risk Assessment
The risk involves unauthorized activation of plugins, which could lead to privilege escalation or unauthorized access to features.
Recommendation
It is recommended to immediately update the Tutor LMS Elementor Addons plugin to a version above 4.0.0 and implement proper access controls for administrative functions.
Other vulnerabilities in Tutor LMS Elementor Addons
Original NVD description (English source)
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS