Authenticated Comment Creation in Tutor LMS WordPress Plugin

Executive Summary

The vulnerability CVE-2026-12273 affects the Tutor LMS WordPress plugin versions before 3.9.13. It allows authenticated users with subscriber-level access or higher to create comments that are automatically approved without any authorization or validation checks.

Specifically, the plugin does not verify if the user is authorized or if the comment is targeted to a valid post before creating the comment. As a result, these users can post comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

Attackers can exploit this by logging in as a subscriber, obtaining a valid nonce from the frontend, and submitting malicious comments via the `tutor_create_lesson_comment` action. The comments are auto-approved and persist hyperlinks while script tags are stripped.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing low-privileged authenticated users to post malicious or unwanted content on your site without moderation.

Since comments are auto-approved and can contain arbitrary HTML and links, attackers could use this to insert spam, phishing links, or other harmful content that could damage your site's reputation or mislead visitors.

Additionally, because comments can be posted on any content including non-existent posts, it could be used to manipulate site content or confuse users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for auto-approved comments containing arbitrary HTML and links posted by authenticated users with subscriber-level access or higher. Since the exploit involves submitting comments via the `tutor_create_lesson_comment` action, checking logs or database entries for comments created without moderation and containing unusual HTML or links can help identify exploitation.

Specifically, detection can involve verifying if comments are being created without passing through the moderation queue and if they contain HTML content or links that are not typical for regular users.

Commands or queries to detect this might include:

• Query the WordPress database comments table for comments with the 'approved' status set to 1 that contain HTML tags or links, especially those created by subscriber-level users.
• Check web server or application logs for POST requests to the `tutor_create_lesson_comment` endpoint or action.
• Use WordPress CLI commands to list recent comments and filter for those with HTML content and approved status.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Tutor LMS WordPress plugin to version 3.9.13 or later, where this vulnerability has been fixed.

Until the update can be applied, consider restricting subscriber-level users from posting comments or disabling the comment feature temporarily to prevent exploitation.

Additionally, review and tighten comment moderation settings to ensure comments are not auto-approved without proper validation.

Useful 0 Not Useful 0