CVE-2026-1372

Name of the Vulnerable Software and Affected Versions Tutor LMS Elementor Addons versions prior to 4.0.1

Description The plugin contains a missing authorization flaw where capability checks are absent in the activate tutor free() and activate elementor free() functions used as admin action * handlers. This allows authenticated users with Subscriber-level permissions or higher to activate the Tutor LMS and Elementor plugins without the required authorization.

Recommendations Update Tutor LMS Elementor Addons to a version newer than 4.0.0. As a temporary mitigation, restrict access to the activate tutor free() and activate elementor free() functions.