CVE-2026-12275
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Tutor LMS WordPress plugin before version 3.9.13 fails to enforce enrollment, purchase, and private-course capability checks in its Droip and Kirki page-builder integration. This allows authenticated users with subscriber-level access to enroll in paid or private courses, read private course content, and mark arbitrary courses as completed.
Risk Assessment
The organization is at risk of unauthorized access to paid and private courses, potentially leading to revenue loss and breach of educational content confidentiality.
Recommendation
Immediately update the Tutor LMS plugin to version 3.9.13 or later. If the Droip or Kirki integration is not needed, consider disabling it.
Other vulnerabilities in Tutor LMS
See all- CVE-2026-15444Medium
The Tutor LMS plugin for WordPress up to version 4.0.1 is vulnerable to generic SQL Injection via the 'coupon_code' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.
- CVE-2026-19092Critical
The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- CVE-2026-16759Medium
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. Missing authorization combined with unsanitized array keys passed to extract() inside tutor_load_template() allow attacker-controlled POST data to overwrite local variables and invoke arbitrary zero-argument PHP functions.
- CVE-2026-19094Medium
The Tutor LMS WordPress plugin before version 4.0.6 does not validate values used to build a database query and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and read question and answer content from courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
- CVE-2026-19093Medium
The Tutor LMS WordPress plugin before version 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can read arbitrary files on the server, including files outside the web root. Readable files include the WordPress configuration file, exposing database credentials and authentication keys and salts, allowing authentication cookies to be forged.
- CVE-2026-14187Low
The Tutor LMS WordPress plugin before version 4.0.6 does not enforce per-object ownership checks on its course content type. This allows any user with the instructor role to read the content of private courses belonging to other instructors.
- CVE-2026-14306Medium
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content. This allows authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.
- CVE-2026-15022Medium
The Tutor LMS plugin for WordPress up to version 4.0.0 inclusive contains a second-order SQL injection vulnerability. An authenticated attacker with custom-level access or higher can store a malicious SQL query in a quiz answer, which executes when a privileged user or REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint.
- CVE-2026-57694Medium
The Tutor LMS plugin for WordPress contains an authorization bypass vulnerability through a user-controlled key. This flaw allows exploiting incorrectly configured access control security levels.
- CVE-2026-12274Medium
The Tutor LMS WordPress plugin before version 3.9.13 fails to verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier. This allows authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Original NVD description (English source)
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.