6.5
Moyenne
CVE-2026-12274 The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target…
Description
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Tutor LMS 3.9 | premières → < 3.9.13 | 3.9.13 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Tutor LMS
Les 18 CVE de Tutor LMS →
CVE-2026-85570
Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure
4.3
Moyenne
CVE-2026-96537
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its…
7.5
Élevée
CVE-2026-85571
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering…
6.5
Moyenne
CVE-2026-85569
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to…
7.2
Élevée