Tutor LMS Plugin Unauthorized Course Enrollment and Completion

Executive Summary

The vulnerability CVE-2026-12275 affects the Tutor LMS WordPress plugin versions before 3.9.13 when the Droip or Kirki page-builder integration is active.

It allows authenticated users with subscriber-level access to bypass important checks related to enrollment, purchase, and private-course capabilities that are normally enforced in the core course handler.

As a result, these users can enroll in paid or private courses without proper authorization, access private course content, and mark any courses as completed.

Useful 0 Not Useful 0

Detection Guidance

To detect the presence of CVE-2026-12275 on your WordPress site, you can follow these steps:

• Check the installed version of the Tutor LMS plugin. The vulnerability affects versions prior to 3.9.13. You can verify the version by navigating to the WordPress admin dashboard, then going to 'Plugins' and locating Tutor LMS in the list.
• Determine if the Droip or Kirki page-builder integration is active. This can be checked in the Tutor LMS settings or by reviewing the active plugins list for Droip or Kirki.
• Review user roles and permissions to identify if any subscriber-level users have performed unauthorized actions, such as enrolling in paid or private courses, accessing private course content, or marking courses as completed without proper authorization.

Commands or tools to assist in detection:

• Use WP-CLI to check the Tutor LMS version: wp plugin list --name=tutor-lms --fields=version
• Check for active Droip or Kirki plugins: wp plugin list --status=active | grep -E 'droip|kirki'
• Review WordPress user activity logs (if available) for suspicious actions by subscriber-level users, such as unexpected course enrollments or completions.

If the plugin version is vulnerable and the Droip or Kirki integration is active, immediate updating to version 3.9.13 or later is recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to paid or private courses on affected Tutor LMS sites.

Users with only subscriber-level access can bypass restrictions, potentially resulting in loss of revenue for course providers as users enroll without payment.

Additionally, unauthorized users can read private course content and mark courses as completed, which can undermine the integrity of course progress tracking and content confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in Tutor LMS can impact compliance with standards and regulations like GDPR and HIPAA due to unauthorized access to sensitive or private course content.

• GDPR: The vulnerability allows unauthorized users to access private course content, which may include personally identifiable information (PII) of students or instructors. Unauthorized access to such data violates GDPR's data protection principles, particularly the requirement to ensure confidentiality and integrity of personal data (Article 5). Organizations may face penalties if they fail to protect PII from unauthorized access.
• HIPAA: If the Tutor LMS is used in a healthcare or educational context involving protected health information (PHI), unauthorized access to private course content could lead to a breach of PHI. HIPAA requires strict access controls and safeguards to prevent unauthorized disclosure of PHI. Failure to address this vulnerability could result in non-compliance with the HIPAA Security Rule (45 CFR Part 164).
• Other regulations: Depending on the industry or region, this vulnerability may also conflict with sector-specific regulations that mandate access controls and data protection, such as FERPA (Family Educational Rights and Privacy Act) in the U.S. for educational institutions.

Organizations using Tutor LMS with the affected integrations should prioritize patching the vulnerability to avoid potential compliance violations and associated legal or financial consequences.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Tutor LMS WordPress plugin to version 3.9.13 or later.

Ensure that the Droip or Kirki page-builder integration is either disabled or updated alongside the core plugin to prevent unauthorized enrollment and access.

Useful 0 Not Useful 0