CVE-2026-1372: Tutor LMS Elementor Auth Bypass Flaw

CVE-2026-1372 Overview

CVE-2026-1372 is a missing authorization vulnerability in the Tutor LMS Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 4.0.0. The plugin fails to enforce capability checks on the activate_tutor_free() and activate_elementor_free() functions registered as admin_action_* handlers. Authenticated users with Subscriber-level access or higher can activate the Tutor LMS and Elementor plugins without proper authorization. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated subscribers can activate plugins on affected WordPress sites, expanding the site's attack surface and potentially enabling further exploitation through activated plugin functionality.

Affected Products

Tutor LMS Elementor Addons plugin for WordPress (all versions ≤ 4.0.0)
WordPress installations with the plugin installed and Subscriber registration enabled
Sites bundling both Tutor LMS and Elementor as installed but inactive plugins

Discovery Timeline

2026-07-21 - CVE-2026-1372 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-1372

Vulnerability Analysis

The vulnerability resides in the Installer.php class of the Tutor LMS Elementor Addons plugin. Two functions, activate_tutor_free() and activate_elementor_free(), are hooked into WordPress admin_action_* handlers. These handlers execute when an authenticated user submits a request to wp-admin/admin.php with a matching action parameter.

Because the handlers do not perform current_user_can() capability checks or verify nonces at the point of execution, any authenticated user can trigger them. WordPress requires that privileged administrative operations validate the caller's role, but this plugin bypasses that requirement. The plugin also fails to enforce Cross-Site Request Forgery (CSRF) protection on the action handlers.

Root Cause

The root cause is the omission of authorization checks on functions that perform privileged actions. Plugin activation in WordPress is normally restricted to users with the activate_plugins capability, held by administrators. By registering activate_tutor_free() and activate_elementor_free() as admin_action_* callbacks without gating them behind capability validation, the plugin exposes plugin activation to all authenticated users.

Attack Vector

An attacker registers or already holds a Subscriber-level account on the target WordPress site. The attacker then sends a crafted HTTP request to wp-admin/admin.php with the action parameter set to the vulnerable handler name. WordPress dispatches the request to the unprotected handler, and the target plugin becomes active. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable code paths.

Detection Methods for CVE-2026-1372

Indicators of Compromise

Unexpected plugin activation events for Tutor LMS or Elementor in WordPress audit logs
HTTP POST or GET requests to /wp-admin/admin.php containing action=activate_tutor_free or action=activate_elementor_free from non-administrator sessions
Recently created Subscriber accounts followed by plugin state changes
Modifications to the active_plugins option in the wp_options database table without a corresponding administrator login

Detection Strategies

Audit WordPress activity logs for plugin activation actions performed by users lacking the activate_plugins capability
Deploy Web Application Firewall (WAF) rules that inspect admin-ajax.php and admin.php requests for the vulnerable action names originating from low-privilege sessions
Compare the installed plugin manifest against a known-good baseline to identify unauthorized state changes

Monitoring Recommendations

Enable WordPress security plugins that log all admin_action_* invocations with the associated user role
Alert on plugin activation events tied to user IDs whose role is Subscriber, Contributor, or Author
Monitor for spikes in new user registrations followed by administrative endpoint traffic

How to Mitigate CVE-2026-1372

Immediate Actions Required

Update the Tutor LMS Elementor Addons plugin to a version later than 4.0.0 once a patched release is available
Temporarily disable the Tutor LMS Elementor Addons plugin if a fix is not yet deployed
Restrict open user registration or set the default role to a custom role without administrative endpoint access
Review recent plugin activation events and audit any changes made through the activated plugins

Patch Information

Review the WordPress Change Log 3.0.1 to 3.0.2 and the WordPress Change Log 3.0.2 to 4.0.0 for the code history. All versions up to and including 4.0.0 remain vulnerable. Monitor the plugin repository for a fixed release that adds capability and nonce checks to the affected handlers.

Workarounds

Deploy WAF rules that block requests to /wp-admin/admin.php containing action=activate_tutor_free or action=activate_elementor_free from unauthenticated or non-administrator sessions
Disable new user registration through Settings → General or restrict registration to trusted domains
Apply a mu-plugin (must-use plugin) that unhooks the vulnerable admin_action_* callbacks until an official patch is released

bash

# Example WAF rule (ModSecurity) to block low-privilege plugin activation
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
  "chain,deny,status:403,id:1026372,msg:'CVE-2026-1372 Tutor LMS Elementor Addons unauthorized activation'"
  SecRule ARGS:action "@rx ^(activate_tutor_free|activate_elementor_free)$"