Skip to content
fr Sign in
7.1 High

CVE-2026-12275 The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the…

Description

The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.

Affected products and versions

Product Affected versions Fixed in
Tutor LMS 3.9 earliest → < 3.9.13 3.9.13

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tutor LMS

The 18 CVEs of Tutor LMS →
CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure 4.3 Medium CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its… 7.5 High CVE-2026-85571 The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering… 6.5 Medium CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to… 7.2 High
Track this CVE