CVE-2026-1371

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.

• CWE-200

• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L106
• https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.5/ecommerce/CouponController.php#L658
• https://plugins.trac.wordpress.org/changeset/3448615/tutor/trunk/ecommerce/CouponController.php?contextall=1&old=3422766&old_path=%2Ftutor%2Ftrunk%2Fecommerce%2FCouponController.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=cve

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13703The SEO Redirection Plugin WordPress plugin before 9.19 doe…5.4
• CVE-2026-13704The GiveWP – Donation Plugin and Fundraising Platform plugin…6.4
• CVE-2026-13705Imager versions before 1.032 for Perl have a heap out-of-bou…7.1
• CVE-2026-13706Improper input validation vulnerability in Wikimedia Foundat…8.8
• CVE-2026-13707Session fixation vulnerability in Wikimedia Foundation OAuth…7.6
• CVE-2026-13708Imager::File::JPEG versions before 1.003 for Perl leak heap …7.5
• CVE-2026-13710The Jeg Kit for Elementor – Powerful Addons for Elementor, W…6.4
• CVE-2026-13713YAML::Syck versions before 1.47 for Perl allow a use-after-f…6.2
• CVE-2026-13714The Realtyna Organic IDX plugin + WPL Real Estate WordPress …9.8
• CVE-2026-13716Path traversal in server import and admin file upload in Cra…9.1
• CVE-2026-13717A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Ga…8.8
• CVE-2026-1372The Tutor LMS Elementor Addons plugin for WordPress is vulne…4.3