CVE-2026-12275: CWE-287 Improper Authentication in Tutor LMS
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
AI Analysis
Technical Summary
The Tutor LMS WordPress plugin versions prior to 3.9.13 contain an authentication bypass vulnerability in its Droip and Kirki page-builder integrations. Unlike the core course handler, these integrations fail to enforce enrollment, purchase, and private-course capability checks. As a result, authenticated users with minimal privileges (subscriber-level) can bypass authorization controls to enroll in paid or private courses, access restricted content, and mark courses as completed without permission.
Potential Impact
Authenticated subscriber-level users can bypass intended access controls to enroll in paid or private courses, read private course content, and mark courses as completed. This undermines the integrity of course access controls and could lead to unauthorized content exposure and misuse of course completion records.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Droip and Kirki page-builder integrations or restricting subscriber-level access to mitigate unauthorized course enrollment and access.
CVE-2026-12275: CWE-287 Improper Authentication in Tutor LMS
Description
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
CVSS v3.1
Score 7.1high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Tutor LMS WordPress plugin versions prior to 3.9.13 contain an authentication bypass vulnerability in its Droip and Kirki page-builder integrations. Unlike the core course handler, these integrations fail to enforce enrollment, purchase, and private-course capability checks. As a result, authenticated users with minimal privileges (subscriber-level) can bypass authorization controls to enroll in paid or private courses, access restricted content, and mark courses as completed without permission.
Potential Impact
Authenticated subscriber-level users can bypass intended access controls to enroll in paid or private courses, read private course content, and mark courses as completed. This undermines the integrity of course access controls and could lead to unauthorized content exposure and misuse of course completion records.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Droip and Kirki page-builder integrations or restricting subscriber-level access to mitigate unauthorized course enrollment and access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-15T11:20:23.214Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5486ae68715ace4350e268
Added to database: 07/13/2026, 06:33:18 UTC
Last enriched: 07/13/2026, 06:48:02 UTC
Last updated: 07/14/2026, 03:41:22 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.