CVE-2026-1372: The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on t
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activate_tutor_free() and activate_elementor_free() functions registered as admin_action_* handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-1372
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-13720.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-1372 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- mediumCVE-2026-18573: A flaw was found in the keycloak-services component of Keycloak, which is used for managing au…2026-08-02
- mediumCVE-2026-18572: Keycloak provides authorization services that allow administrators to restrict access to resou…2026-08-02
- mediumCVE-2026-18571: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permission…2026-08-02
- mediumCVE-2026-18570: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-service…2026-08-02
- unknownCVE-2026-16540: The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict …2026-08-02