EUVD-2026-43288
GHSA-cwrv-whxp-7g78
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber-level authentication (PR:L) is required; impact is limited to integrity injection with no confidentiality or availability exposure, and scope is unchanged.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
AnalysisAI
Tutor LMS WordPress plugin (all versions before 3.9.13) allows authenticated users with subscriber-level access to post auto-approved comments containing arbitrary HTML and external links on any site content, bypassing the comment moderation queue entirely. The vulnerable comment handler performs no authorization check and no post-target validation before creating comments, making this exploitable by any registered user on sites with open registration - a common LMS deployment pattern. A publicly available POC from WPScan exists; no CISA KEV listing indicates confirmed mass exploitation, but the low privilege bar and POC availability make this a realistic content-integrity threat.
Technical ContextAI
The vulnerability exists within the Tutor LMS WordPress plugin (CPE: cpe:2.3:a:unknown:tutor_lms:*:*:*:*:*:*:*:*), a Learning Management System plugin widely used for course delivery on WordPress sites. The root cause, though listed as CWE N/A in the input, is functionally equivalent to CWE-862 (Missing Authorization): one of the plugin's internal AJAX or REST comment-creation handlers fails to verify whether the authenticated caller holds permission to comment on the specified target post, and performs no validation of the target post's identity or type. Compounding this, the handler stores submitted comments with pre-approved status, completely bypassing WordPress's native comment moderation queue - a mechanism most sites rely on as the primary spam and abuse control layer. The result is that subscriber-level users, who under normal WordPress operation have minimal capabilities, can inject arbitrary HTML markup and hyperlinks into any post or page on the site.
RemediationAI
Upgrade Tutor LMS to version 3.9.13 or later, which is the vendor-released patch that introduces proper authorization checks and post-target validation in the affected comment handler (patch available per vendor advisory at https://wpscan.com/vulnerability/93031a51-fd53-48a0-a420-0024bbdaf45b/). No exact fix version beyond 3.9.13 is referenced in available data. As a compensating control pending upgrade, administrators should disable public user self-registration under WordPress Settings > General if it is not operationally required - this eliminates the trivial path to subscriber-level access for unauthenticated attackers, though it may impact legitimate LMS enrollment flows that rely on self-signup. Additionally, enabling the WordPress comment moderation queue for all non-admin users and routing all comments to a held-for-review state can limit the visibility of injected content, but does not remediate the authorization flaw itself. Monitoring comment activity logs for anomalous volume or HTML content from subscriber accounts can aid in detecting active abuse.
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers o
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data
Several AJAX endpoints in the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7.7 were unprot
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowi
Broken authorization in the Tutor LMS WordPress plugin (before 3.9.13) lets authenticated subscriber-level users bypass
Broken object-level authorization in the Tutor LMS WordPress plugin before 3.9.13 allows any authenticated instructor-le
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS - eLearning and online course soluti
The tutor_place_rating AJAX action from the Tutor LMS - eLearning and online course solution WordPress plugin before 1.7
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS - eLearning and online course solution WordPress
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today