Authorization Flaw in Tutor LMS Plugin Enables Comment Bypass for WordPress Users
CVE-2026-12273
Key Information:
Badges
What is CVE-2026-12273?
The Tutor LMS WordPress plugin prior to version 3.9.13 contains a significant security flaw that allows authenticated users, including those with subscriber-level access and above, to post comments without undergoing the appropriate authorization checks. This vulnerability enables the posting of auto-approved comments that may include arbitrary HTML and links, effectively bypassing the standard comment moderation process. This poses a risk as it allows potential abuse of comments sections across the site, making it crucial for users to update to the latest version to mitigate these risks.
Affected Version(s)
Tutor LMS 0 < 3.9.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.