CVE-2026-12273: Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12273?
The severity of CVE-2026-12273 is rated as medium with a CVSS score of 4.3.
How do I fix CVE-2026-12273?
To mitigate CVE-2026-12273, update the Tutor LMS plugin to version 3.9.13 or later.
What impact does CVE-2026-12273 have on my WordPress site?
CVE-2026-12273 allows authenticated users with subscriber-level access to post arbitrary auto-approved comments, potentially leading to spam or misinformation.
Who is affected by CVE-2026-12273?
Users of the Tutor LMS WordPress plugin before version 3.9.13 may be affected by CVE-2026-12273.
Is it safe to use Tutor LMS versions prior to 3.9.13 with CVE-2026-12273?
Using Tutor LMS versions prior to 3.9.13 is not safe due to the vulnerability that allows unauthorized comment creation.