CVE-2026-12274

Name of the Vulnerable Software and Affected Versions Tutor LMS WordPress plugin versions prior to 3.9.13

Description The plugin fails to verify if the requesting user has the necessary permissions to edit a target post before overwriting it within a content-builder save handler. The system only validates the request against an unrelated identifier. This allows authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

Recommendations Update Tutor LMS WordPress plugin to version 3.9.13 or later.