CVE-2026-12271 Overview
CVE-2026-12271 is a broken access control vulnerability in the Tutor LMS WordPress plugin versions prior to 3.9.13. The plugin fails to verify ownership of quiz attempts before writing to them. Authenticated users with subscriber-level access or above can modify and force-complete other students' quiz attempts. Attackers can overwrite recorded marks and pass/fail results belonging to other students, corrupting academic records within the learning management system.
Critical Impact
Any authenticated subscriber can tamper with other students' quiz attempts, forcing completion states and overwriting grades stored by the Tutor LMS plugin.
Affected Products
- Tutor LMS WordPress plugin versions before 3.9.13
- WordPress sites running Tutor LMS with subscriber registration enabled
- Learning management deployments exposing quiz attempt endpoints to authenticated users
Discovery Timeline
- 2026-07-13 - CVE-2026-12271 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-12271
Vulnerability Analysis
The vulnerability is an Insecure Direct Object Reference (IDOR) affecting Tutor LMS quiz attempt handling. The plugin exposes an authenticated endpoint that accepts a quiz attempt identifier and updates the attempt record. The handler does not confirm that the current user owns the referenced attempt before writing to it.
An attacker with a subscriber account, the lowest privileged WordPress role that can register on many sites, can supply an attempt ID belonging to another student. The server processes the request and overwrites the target attempt's answers, completion status, marks, and pass/fail flag. This yields limited integrity impact against quiz records and limited availability impact because legitimate results are destroyed.
Review the WPScan Vulnerability Report for the specific handler and parameters involved.
Root Cause
The root cause is a missing authorization check on the quiz attempt write path. The plugin trusts the attempt ID supplied by the client without confirming the attempt belongs to the requesting user. This pattern is classified as Broken Access Control and Insecure Direct Object Reference.
Attack Vector
Exploitation requires an authenticated account at subscriber level or higher. The attacker sends a crafted POST request referencing a target attempt ID. No user interaction from the victim is required. The attack is network-reachable through the standard WordPress admin-ajax or REST endpoints exposed by the plugin.
No public proof-of-concept exploit is listed in the enriched data. See the WPScan advisory linked above for technical specifics.
Detection Methods for CVE-2026-12271
Indicators of Compromise
- Quiz attempt records showing modification timestamps that do not match the enrolled student's session activity.
- Unexpected pass/fail state changes for attempts belonging to students who did not re-submit.
- WordPress access logs showing subscriber accounts issuing repeated POST requests to Tutor LMS quiz attempt endpoints.
Detection Strategies
- Audit the Tutor LMS quiz attempt database tables for entries where the last-modifying user does not match the attempt owner.
- Correlate WordPress authentication logs with plugin endpoint access to identify subscriber accounts writing to attempts they do not own.
- Alert on high-volume POST requests to Tutor LMS AJAX or REST routes originating from low-privilege accounts.
Monitoring Recommendations
- Enable WordPress request logging on all Tutor LMS endpoints and forward logs to a central SIEM.
- Monitor creation of new subscriber accounts followed by rapid activity against quiz attempt endpoints.
- Track integrity of wp_tutor_quiz_attempts and related tables using periodic hash or row-count baselines.
How to Mitigate CVE-2026-12271
Immediate Actions Required
- Update the Tutor LMS plugin to version 3.9.13 or later on all WordPress instances.
- Review quiz attempt records for tampering that occurred prior to patching and restore from backups where required.
- Audit subscriber account registrations and disable accounts that show suspicious quiz endpoint activity.
Patch Information
The vendor addressed the flaw in Tutor LMS 3.9.13 by adding ownership verification before quiz attempt writes. Administrators should upgrade through the WordPress plugin manager or by deploying the updated package. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict user registration on affected sites until the plugin is upgraded.
- Deploy a web application firewall rule that blocks POST requests to Tutor LMS quiz attempt endpoints from subscriber-level accounts.
- Temporarily disable quiz functionality in Tutor LMS if immediate patching is not possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
