Tutor LMS Elementor Addons CVE-2026-1372

Exploitation requires a valid WordPress account at Subscriber level or higher - unauthenticated visitors cannot trigger the vulnerable functions. The admin_action_* handler must be reachable, which is the default behavior for any WordPress installation running this plugin with no additional access restrictions on wp-admin. The vulnerability is not configuration-dependent beyond the plugin being installed and active. Limiting factors: attackers without any WordPress account on the target site cannot exploit this flaw; sites with closed registration or tightly controlled user roles reduce the realistic attacker pool. Exploitation does not grant code execution, data exfiltration, or administrative credential access - impact is confined to unauthorized activation of the Tutor LMS or Elementor plugins.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields a 4.3 Medium score, which accurately reflects the constrained impact: an attacker must already hold a WordPress account (PR:L), cannot read data (C:N) or disrupt availability (A:N), and can only influence integrity by activating plugins the administrator may not have intended to enable (I:L). No EPSS data was supplied. KEV status is absent, and no public exploit code is referenced in the provided intelligence. The practical risk is further bounded by the requirement for an existing authenticated session - unauthenticated visitors cannot exploit this flaw. While activating an unintended plugin could have downstream consequences (for example, if Tutor LMS or Elementor introduces additional attack surface once active), this is a secondary effect, not direct impact. Overall, this is a real but low-priority finding for most deployments: it warrants patching on schedule but does not represent an emergency response scenario absent evidence of active exploitation or a chained attack.

An attacker who possesses or registers a low-privilege WordPress Subscriber account crafts an HTTP GET or POST request to the WordPress admin endpoint with an action parameter matching the admin_action_activate_tutor_free or admin_action_activate_elementor_free hook. Because no capability check is enforced, WordPress processes the request and activates the target plugin as if an administrator had done so. No public proof-of-concept code is referenced in the available intelligence, but the attack surface is trivially discoverable by inspecting the plugin source on WordPress Trac.