CVE-2026-12274 Overview
CVE-2026-12274 is a broken access control vulnerability in the Tutor LMS WordPress plugin before version 3.9.13. The plugin's content-builder save handlers fail to verify that the requesting user is authorized to edit a target post before overwriting it. Instead, the handlers authorize the request against an unrelated identifier. Authenticated users with instructor-level access can overwrite any post or page on the site, including content owned by administrators.
Critical Impact
An authenticated instructor can take over administrator-owned pages, replace site content, and pivot toward broader site compromise through post manipulation.
Affected Products
- Tutor LMS WordPress plugin versions prior to 3.9.13
- WordPress sites running Tutor LMS with instructor-level accounts enabled
- Multi-author WordPress installations using Tutor LMS for course delivery
Discovery Timeline
- 2026-07-13 - CVE-2026-12274 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-12274
Vulnerability Analysis
The flaw resides in one of the Tutor LMS content-builder save handlers. When a request reaches the handler, the plugin performs an authorization check against an identifier that is unrelated to the target post being modified. The handler then proceeds to overwrite the referenced post using attacker-controlled data.
Because the authorization check does not validate ownership or edit rights against the actual target post ID, the check provides no meaningful protection. Any authenticated user who meets the unrelated authorization criteria, such as holding the instructor role granted by Tutor LMS, can direct the handler to overwrite arbitrary posts. This behavior maps to a classic broken access control weakness [CWE-284] and an insecure direct object reference pattern [CWE-639].
Root Cause
The root cause is missing per-object authorization. The save handler validates the caller against a role capability or a secondary identifier but does not call WordPress functions such as current_user_can('edit_post', $post_id) against the post targeted for overwrite. This decouples authorization from the object being modified.
Attack Vector
An attacker first obtains an authenticated instructor account on the target site, either through legitimate registration on sites that permit instructor sign-up or through credential compromise. The attacker then submits a crafted request to the vulnerable content-builder save endpoint, supplying the target post identifier belonging to an administrator or another privileged user. The handler accepts the request and replaces the target post content with attacker-supplied data.
The attacker can use overwritten pages to host phishing content, defacements, or JavaScript payloads that target site visitors and logged-in administrators.
Detection Methods for CVE-2026-12274
Indicators of Compromise
- Unexpected modifications to posts or pages owned by administrator accounts, particularly changes attributed to instructor users
- POST requests to Tutor LMS content-builder AJAX endpoints referencing post IDs outside the caller's authored content
- New or altered post revisions in wp_posts and wp_postmeta where post_author does not match the user who triggered the update
Detection Strategies
- Enable WordPress audit logging to capture every post_updated and wp_insert_post action, including the acting user and target post ID
- Correlate web server access logs against Tutor LMS AJAX endpoints and flag requests where the acting user role is instructor but the target post is owned by an administrator
- Alert on any request to Tutor LMS save handlers that produces a post revision on content the caller does not own
Monitoring Recommendations
- Baseline the volume and pattern of instructor-driven post edits and alert on deviations
- Monitor for sudden appearance of iframes, external scripts, or redirect logic within existing published pages
- Track newly registered instructor accounts and correlate their activity with post edit events during the first 24 hours after signup
How to Mitigate CVE-2026-12274
Immediate Actions Required
- Upgrade the Tutor LMS plugin to version 3.9.13 or later on all WordPress sites
- Audit the list of users holding the Tutor LMS instructor role and remove accounts that are not required
- Review post revision history for administrator-owned pages and restore any content that was overwritten by non-owners
Patch Information
The vendor addressed the issue in Tutor LMS 3.9.13 by adding per-post authorization inside the affected content-builder save handlers. Refer to the WPScan Vulnerability Details for the disclosure record and fix reference.
Workarounds
- Temporarily disable instructor self-registration and restrict the instructor role to trusted, vetted users until the patch is applied
- Place the Tutor LMS AJAX endpoints behind a web application firewall rule that inspects the target post ID and blocks requests where the caller is not the post author
- Deactivate the Tutor LMS plugin on high-value sites where an upgrade cannot be scheduled immediately
# Update Tutor LMS to the patched release using WP-CLI
wp plugin update tutor --version=3.9.13
# Verify the installed version after the update
wp plugin get tutor --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
