CVE-2026-12275: high-severity vulnerability in Tutor LMS
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.1epss 0.3%
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
Unknown · Tutor LMSpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/fcd43a87-8721-4455-b014-ac81d53fc671/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Tutor LMS
In the same product, most dangerous first.
CVE-2026-19092CRITICALTutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable ShadowingEPSS 2.6%CVE-2023-0236MEDIUMTutor LMS < 2.0.10 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2023-3133—Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST APIEPSS 1.0%CVE-2023-4805MEDIUMTutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-85569HIGHTutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request MisclassificationEPSS 0.5%CVE-2026-19093MEDIUMTutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video PathEPSS 0.5%