CVE-2026-12271: CWE-639 Authorization Bypass Through User-Controlled Key in Tutor LMS
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
AI Analysis
Technical Summary
CVE-2026-12271 is an authorization bypass vulnerability in the Tutor LMS WordPress plugin prior to version 3.9.13. The plugin fails to verify ownership of targeted quiz attempts before allowing modifications. As a result, authenticated users with subscriber-level access or above can alter other students' quiz attempts, including forcing completion and changing recorded scores and pass/fail outcomes. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation details are provided.
Potential Impact
The vulnerability allows unauthorized modification of quiz attempt data by authenticated users with low-level privileges. This can lead to integrity loss of quiz results, unfair academic outcomes, and potential abuse of the learning management system's grading process.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to quiz attempts.
CVE-2026-12271: CWE-639 Authorization Bypass Through User-Controlled Key in Tutor LMS
Description
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12271 is an authorization bypass vulnerability in the Tutor LMS WordPress plugin prior to version 3.9.13. The plugin fails to verify ownership of targeted quiz attempts before allowing modifications. As a result, authenticated users with subscriber-level access or above can alter other students' quiz attempts, including forcing completion and changing recorded scores and pass/fail outcomes. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation details are provided.
Potential Impact
The vulnerability allows unauthorized modification of quiz attempt data by authenticated users with low-level privileges. This can lead to integrity loss of quiz results, unfair academic outcomes, and potential abuse of the learning management system's grading process.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to quiz attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-15T11:01:00.374Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5486ae68715ace4350e25f
Added to database: 07/13/2026, 06:33:18 UTC
Last enriched: 07/13/2026, 06:48:17 UTC
Last updated: 07/14/2026, 03:35:57 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.