CVE-2026-1372
Received Received - Intake

Missing Authorization in Tutor LMS Elementor Addons WordPress Plugin

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Wordfence

Description
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-1372
EUVD
EUVD-2026-46167

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeum tutor_lms_elementor_addons to 4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tutor LMS Elementor Addons plugin for WordPress has a vulnerability due to missing authorization checks in versions up to 4.0.0. Authenticated attackers with Subscriber-level access or higher can activate the Tutor LMS and Elementor plugins without proper permission by exploiting missing capability checks on specific functions.

Detection Guidance

Check WordPress plugins for Tutor LMS Elementor Addons versions up to 4.0.0. Review admin logs for unauthorized plugin activations by Subscriber-level users or above.

Impact Analysis

This vulnerability allows attackers to enable plugins they are not authorized to use. This could lead to unauthorized changes in website functionality, potential data exposure, or further exploitation of other vulnerabilities in the activated plugins.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to activate plugins without proper authorization. This could lead to unauthorized changes in a WordPress environment, potentially compromising data integrity and access controls. Such unauthorized access may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized modifications or access to sensitive data.

Mitigation Strategies

Update the Tutor LMS Elementor Addons plugin to the latest version. Remove unnecessary admin privileges for Subscriber-level users. Monitor plugin activations for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart