CVE-2026-12273: Tutor LMS WordPress Plugin XSS Flaw

CVE-2026-12273 Overview

CVE-2026-12273 affects the Tutor LMS WordPress plugin in versions prior to 3.9.13. The plugin fails to perform authorization or post-target validation before creating a comment in one of its handlers. Comments created through this handler are stored as pre-approved, bypassing the standard WordPress moderation queue.

Authenticated users with subscriber-level access or above can post auto-approved comments containing arbitrary HTML and links on any content across the site. The flaw enables spam injection, link seeding, and phishing lures on posts that would otherwise require moderator approval. This is a broken access control issue [CWE-862] combined with insufficient input validation.

Critical Impact
Any authenticated subscriber can publish auto-approved comments containing arbitrary HTML and links on any site content, bypassing moderation entirely.

Affected Products

Tutor LMS WordPress plugin versions prior to 3.9.13
WordPress sites permitting subscriber-level registration with Tutor LMS installed
Learning management deployments relying on comment moderation for user-generated content

Discovery Timeline

2026-07-13 - CVE-2026-12273 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12273

Vulnerability Analysis

The vulnerability resides in a comment creation handler within the Tutor LMS plugin. The handler accepts requests from authenticated users but does not verify whether the caller is authorized to comment on the specified target. It also fails to validate the target post identifier against permitted contexts such as course content.

Because the handler marks comments as approved on insertion, the WordPress comment moderation queue never processes the submitted content. Comments containing HTML tags and hyperlinks appear immediately on the target post. The attacker requires only a valid subscriber account, which is often obtainable through open registration on WordPress sites.

Root Cause

The root cause is missing authorization enforcement combined with a pre-approved insertion path. The handler trusts the client-supplied post target and comment payload without applying capability checks such as current_user_can() or moderation filters like wp_allow_comment(). Content is written directly to the comments table with comment_approved set to 1.

Attack Vector

An attacker registers or logs in with a subscriber-level account. The attacker then issues a request to the vulnerable Tutor LMS comment handler, specifying an arbitrary post_id and comment body containing HTML markup and outbound links. The server persists the comment as approved and displays it publicly without administrator review. Refer to the WPScan Vulnerability Report for the disclosed handler details.

Detection Methods for CVE-2026-12273

Indicators of Compromise

Comments on non-Tutor LMS posts authored by subscriber-role accounts with comment_approved = 1 and no prior moderation history
Sudden increase in outbound links or HTML anchor tags in comment bodies from low-privilege users
POST requests to Tutor LMS AJAX or REST endpoints containing comment_content or comment_post_ID parameters from subscriber sessions
New subscriber registrations followed shortly by comment activity across unrelated posts

Detection Strategies

Query the wp_comments table for approved comments authored by users whose highest role is subscriber and correlate with post authorship
Inspect web server access logs for POST requests to Tutor LMS handler URIs originating from authenticated sessions with subscriber cookies
Alert on comment insertions where the comment target post is not a Tutor LMS course or lesson post type

Monitoring Recommendations

Enable WordPress audit logging for comment creation events and user role assignments
Forward WordPress and web server logs to a central SIEM for correlation across authentication, registration, and comment activity
Track wp_insert_comment hook activity to identify comments bypassing the pre_comment_approved filter chain

How to Mitigate CVE-2026-12273

Immediate Actions Required

Update the Tutor LMS plugin to version 3.9.13 or later on all WordPress instances
Audit the wp_comments table for approved comments authored by subscriber-role users and remove or re-moderate suspicious entries
Review and remove subscriber accounts that appear to have been created solely to abuse the comment handler

Patch Information

The vendor addressed the issue in Tutor LMS version 3.9.13 by adding authorization checks and removing the pre-approved insertion path. Administrators should apply the update through the WordPress plugin manager or by replacing plugin files with the fixed release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration or restrict the subscriber role until the plugin is updated
Temporarily deactivate the Tutor LMS plugin on sites that cannot patch immediately
Enforce comment moderation globally by requiring manual approval for all comments in WordPress Discussion settings
Deploy a web application firewall rule blocking requests to the vulnerable Tutor LMS comment handler from non-instructor roles

bash

# Configuration example: enforce global comment moderation in wp-config or via WP-CLI
wp option update comment_moderation 1
wp option update comment_previously_approved 1
wp option update default_comment_status closed