Tutor LMS CVE-2026-12271

Exploitation requires the attacker to hold a valid WordPress account at subscriber level or above - the minimum role typically granted upon self-registration. The site must have Tutor LMS installed and active with at least one quiz configured. The attacker must be able to supply or enumerate a target quiz attempt ID belonging to another user; the CVSS AC:L rating implies this ID-guessing step is not considered a meaningful barrier. Exploitation is limited to WordPress sites running Tutor LMS versions below 3.9.13. Sites where user registration is disabled and all accounts are admin-provisioned have a significantly reduced exposure surface, as external attackers cannot self-create subscriber accounts.

The CVSS 5.4 Medium score reflects PR:L (requires a low-privilege authenticated account), with Integrity and Availability impacts both rated Low. Real-world risk is meaningfully elevated beyond the raw score due to two compounding factors: a publicly available exploit is documented by WPScan (https://wpscan.com/vulnerability/ca99ea35-4bf8-4dc8-a817-79fb9fa1c5bd/), and WordPress subscriber accounts are trivially obtained on most course-selling or open-enrollment LMS sites. The practical threat is academic fraud - students manipulating rivals' results or boosting their own standing in graded environments. No EPSS score was provided in the supplied data, so exploitation probability cannot be quantified; this is a gap to note. The CVE is not in CISA KEV, suggesting no confirmed widespread campaigns, but the low barrier (any registered student) combined with a known PoC makes this a realistic, near-term exploitation risk for any WordPress-based LMS using this plugin.

A student enrolled in a WordPress-based online course registers or already holds a subscriber-level account and identifies a competitor's quiz attempt ID - either by brute-forcing sequential IDs or observing network traffic in a shared session context. The attacker sends a crafted POST request to the Tutor LMS quiz attempt write endpoint, substituting the victim's attempt ID, and submits arbitrary answer data that forces a passing score. A public exploit proof-of-concept is available via WPScan, lowering the technical skill threshold required.