Tutor LMS CVE-2026-12273

Exploitation requires a valid WordPress account with at minimum subscriber-level privileges. On WordPress LMS sites with open user self-registration enabled, this privilege level is freely obtainable by any external actor without any prior relationship with the site. The vulnerability is present in the default Tutor LMS installation on all versions before 3.9.13 - no special server configuration, non-default feature flag, or unusual deployment mode is required. Exploitation is bounded by two concrete prerequisites: (1) Tutor LMS version less than 3.9.13 must be active on the target WordPress installation, and (2) the attacker must hold at least a subscriber-level authenticated session. No administrator or victim user interaction is required for the injected comment to appear publicly. Exploitation is constrained to content integrity - no server-side code execution, no access to credentials or private data, and no availability impact are possible through this vector.

The official CVSS 3.1 score of 4.3 (Medium) accurately captures the constrained technical scope: network vector (AV:N), low complexity (AC:L), low privileges required (PR:L - subscriber), no user interaction (UI:N), unchanged scope (S:U), and integrity-only impact (I:L) with no confidentiality or availability consequence. However, the practical risk exceeds what the score suggests in certain deployment contexts. On LMS sites with open user self-registration - a standard configuration for public courses - subscriber accounts are trivially obtainable by any external attacker, effectively lowering the functional privilege bar toward unauthenticated. The publicly available POC from WPScan further reduces the skill threshold for exploitation. There is no CISA KEV listing, so confirmed widespread active exploitation is not established. EPSS data was not provided. The primary real-world impact is content integrity: injected HTML, phishing links, or spam content appearing publicly on course pages, blog posts, or landing pages without any moderation review. This is a genuine remediation priority for any Tutor LMS site with open user registration, but lower urgency for sites where only trusted admins or enrolled students hold accounts.

An attacker self-registers a free subscriber account on a WordPress site running Tutor LMS before 3.9.13 - a typical scenario on sites offering public course enrollment. Using the publicly available WPScan POC, the attacker sends a crafted request to the plugin's comment handler targeting a high-traffic course page or blog post, including HTML containing phishing links or malicious redirects. The comment is immediately stored as pre-approved and rendered publicly on the target page without any administrator review, exposing all site visitors to the injected content.