Skip to content
fr Sign in
4.3 Medium

CVE-2026-12273 The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before…

Description

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS 3.9 earliest → < 3.9.13 3.9.13

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tutor LMS

The 18 CVEs of Tutor LMS →
CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure 4.3 Medium CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its… 7.5 High CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering… 6.5 Medium CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to… 7.2 High
Track this CVE