What’s Vulnerable › Vulnerabilities
CVE-2026-12274: Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-13 · updated 2026-07-13
Description
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Affected products
- themeum Tutor LMS – eLearning and online course solution: before 3.9.13 — fixed in 3.9.13
How to fix
Upgrade to a fixed version: themeum Tutor LMS – eLearning and online course solution 3.9.13. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12274 or the next vulnerability affects your stack