CVE-2026-12275: Tutor LMS Auth Bypass Vulnerability

CVE-2026-12275 Overview

CVE-2026-12275 is a broken access control vulnerability in the Tutor LMS WordPress plugin versions before 3.9.13. The plugin's Droip and Kirki page-builder integration omits the enrollment, purchase, and private-course capability checks enforced by the core course handler. Authenticated users with subscriber-level access can enroll in paid or private courses without authorization. Attackers can also read private course content and mark arbitrary courses as completed. The flaw affects sites where the Droip or Kirki integration is active.

Critical Impact
Subscriber-level users can bypass paid enrollment, access private course material, and forge course completion status on affected WordPress sites.

Affected Products

Tutor LMS WordPress plugin versions prior to 3.9.13
Sites with the Droip page-builder integration active
Sites with the Kirki page-builder integration active

Discovery Timeline

2026-07-13 - CVE-2026-12275 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12275

Vulnerability Analysis

The Tutor LMS plugin implements capability and enrollment validation inside its core course handler. These checks confirm that a user has purchased a course, has been granted enrollment, or holds the correct role to view private course content. The Droip and Kirki page-builder integrations expose parallel endpoints that render course data and update completion state. These parallel paths fail to invoke the same access control routines. Any authenticated user, including the low-privilege subscriber role, can invoke the integration endpoints to trigger enrollment, load restricted lesson content, and set completion flags. The result is a business logic and broken access control failure [CWE-284, CWE-862] that undermines the plugin's monetization and content protection model.

Root Cause

The root cause is missing authorization enforcement in the Droip and Kirki integration handlers. The developers duplicated course interaction logic without duplicating the enrollment, purchase, and private-course capability checks present in the core handler. This inconsistent enforcement creates an authorization bypass path around paid-content gating.

Attack Vector

The attack requires network access to the WordPress site and a valid authenticated session at subscriber level or higher. Subscriber accounts are typically created through open self-registration on many WordPress deployments. An attacker crafts requests to the Droip or Kirki integration endpoints exposed by Tutor LMS. The requests include a target course identifier and trigger enrollment, content retrieval, or completion actions without triggering paywall or role checks.

No public proof-of-concept code or verified exploit sample is available for CVE-2026-12275. Refer to the WPScan Vulnerability Description for additional technical context.

Detection Methods for CVE-2026-12275

Indicators of Compromise

Enrollment records for subscriber accounts on paid or private courses without corresponding order or payment entries in the WooCommerce or EDD tables.
Course completion events attributed to users who never accessed lesson pages or submitted quizzes.
Unexpected POST or AJAX traffic to Droip or Kirki integration endpoints originating from low-privilege user sessions.
New subscriber-role accounts registered shortly before enrollment or completion anomalies appear.

Detection Strategies

Audit the wp_tutor_enrolled and course meta tables to identify enrollments that lack matching payment or manual-enrollment records.
Review web server access logs for authenticated requests to Tutor LMS integration routes and correlate with the requesting user's role.
Compare course completion timestamps against lesson view telemetry to surface completions without prior content interaction.

Monitoring Recommendations

Enable verbose logging on the Tutor LMS plugin and forward WordPress audit logs to a centralized log store for role-based analysis.
Alert on bulk enrollment or completion actions performed by a single subscriber account within a short window.
Track newly created accounts that immediately interact with paid course endpoints.

How to Mitigate CVE-2026-12275

Immediate Actions Required

Upgrade the Tutor LMS plugin to version 3.9.13 or later on all WordPress sites.
Audit existing enrollments and completion records created since the Droip or Kirki integration was enabled and revoke unauthorized entries.
Disable open user self-registration or restrict the default new-user role if subscriber accounts are not required.

Patch Information

The vendor addressed the issue in Tutor LMS 3.9.13 by adding the missing enrollment, purchase, and private-course capability checks to the Droip and Kirki integration handlers. Site operators should apply the update through the WordPress plugin manager or WP-CLI. See the WPScan Vulnerability Description for reference details.

Workarounds

Deactivate the Droip page-builder integration until the plugin is updated.
Deactivate the Kirki page-builder integration until the plugin is updated.
Restrict access to Tutor LMS integration endpoints at the web application firewall based on user role or request pattern.

bash

# Update Tutor LMS to the fixed version using WP-CLI
wp plugin update tutor --version=3.9.13

# Verify the installed version
wp plugin get tutor --field=version

# Temporary workaround: deactivate page-builder integrations
wp plugin deactivate droip
wp plugin deactivate kirki