CVE-2026-12274: Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12274?
CVE-2026-12274 has a medium severity rating of 6.5.
How do I fix CVE-2026-12274?
To fix CVE-2026-12274, update the Tutor LMS WordPress plugin to version 3.9.13 or later.
What type of vulnerability is CVE-2026-12274?
CVE-2026-12274 is an arbitrary post overwrite vulnerability due to improper authorization in the Tutor LMS plugin.
Who is affected by CVE-2026-12274?
Authenticated users with instructor-level access in the Tutor LMS plugin before version 3.9.13 are affected by CVE-2026-12274.
What can attackers do with CVE-2026-12274?
Attackers can exploit CVE-2026-12274 to overwrite posts they should not have permission to edit.