CVE-2026-1372

EUVD-2026-46167

21.07.2026, 09:16

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Wordfence	CNA	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 10%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
themeum	tutor_lms_elementor_addons	𝑥 ≤ 4.0.0	CNA

Common Weakness Enumeration

CWE-862 - Missing Authorization
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

References

https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L213

https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L222

https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L29

https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor-lms-elementor-addons/tags/3.0.1&new_path=%2Ftutor-lms-elementor-addons/tags/3.0.2

https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor-lms-elementor-addons/tags/3.0.2&new_path=%2Ftutor-lms-elementor-addons/tags/4.0.0

https://www.wordfence.com/threat-intel/vulnerabilities/id/8a276a3e-12c3-4af7-9eb8-a25d20563de7?source=cve