Tutor LMS CVE-2026-12275

Requires an authenticated account at subscriber level or above (CVSS PR:L), reachable over the network with no user interaction (AV:N/UI:N). The decisive prerequisite named in the description is that the Droip or Kirki page-builder integration must be active on the site - the vulnerable handlers exist only in that integration, so sites without it are not exploitable. Exploitation is further bounded by the target running Tutor LMS below 3.9.13 and by the site permitting the attacker to obtain a low-privilege account (e.g., open registration). No admin rights, no special client platform, and no victim interaction are needed once those conditions hold.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1 High) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction - consistent with a logged-in subscriber abusing a WordPress site that allows open registration. A publicly available exploit exists (WPScan), raising practical exploitability, but there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation is not confirmed. A key limiting factor tempers the raw score: exploitation only works when the Droip or Kirki integration is active, a non-default configuration, so the real-world exposed population is a subset of Tutor LMS installs. The C:H rating also merits scrutiny - the disclosed asset is private/paid course content rather than credentials or system data, which is arguably a lower confidentiality impact; verify sensitivity per deployment. Net: a genuine access-control/business-logic priority for affected sites (revenue bypass plus content disclosure), but scoped by the integration prerequisite rather than a blanket internet-wide threat.

An attacker registers a free subscriber account (or uses any existing low-privileged login) on a WordPress site running vulnerable Tutor LMS with the Droip or Kirki integration enabled. Using the publicly documented WPScan technique, they invoke the integration's course actions to enroll in a paid course without payment, read the private course content, and mark it as completed - obtaining paid material and completion status for free, over the network and with no user interaction.