CVE-2026-1371

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.

• CWE-200

• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L106
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L658
• https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/ecommerce/CouponController.php?contextall=1&old=3422766&old_path=%2Ftutor%2Ftrunk%2Fecommerce%2FCouponController.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=cve

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13704The GiveWP – Donation Plugin and Fundraising Platform plugin…6.4
• CVE-2026-13705Imager versions before 1.032 for Perl have a heap out-of-bou…7.1
• CVE-2026-13706Improper input validation vulnerability in Wikimedia Foundat…8.8
• CVE-2026-13707Session fixation vulnerability in Wikimedia Foundation OAuth…7.6
• CVE-2026-13708Imager::File::JPEG versions before 1.003 for Perl leak heap …7.5
• CVE-2026-13709The Graphina – Charts and Graphs For Elementor plugin for Wo…6.4
• CVE-2026-13710The Jeg Kit for Elementor – Powerful Addons for Elementor, W…6.4
• CVE-2026-13712The Divi WordPress theme before 5.9.0 does not properly esca…5.4
• CVE-2026-13713YAML::Syck versions before 1.47 for Perl allow a use-after-f…6.2
• CVE-2026-13714The Realtyna Organic IDX plugin + WPL Real Estate WordPress …9.8
• CVE-2026-13716Path traversal in server import and admin file upload in Cra…9.1
• CVE-2026-13717A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Ga…8.8