Tutor LMS Plugin Unauthorized Course Enrollment and Completion

Executive Summary

The vulnerability CVE-2026-12275 affects the Tutor LMS WordPress plugin versions before 3.9.13 when the Droip or Kirki page-builder integration is active.

It allows authenticated users with subscriber-level access to bypass important checks related to enrollment, purchase, and private-course capabilities that are normally enforced in the core course handler.

As a result, these users can enroll in paid or private courses without proper authorization, access private course content, and mark any courses as completed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to paid or private courses on affected Tutor LMS sites.

Users with only subscriber-level access can bypass restrictions, potentially resulting in loss of revenue for course providers as users enroll without payment.

Additionally, unauthorized users can read private course content and mark courses as completed, which can undermine the integrity of course progress tracking and content confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Tutor LMS WordPress plugin to version 3.9.13 or later.

Ensure that the Droip or Kirki page-builder integration is either disabled or updated alongside the core plugin to prevent unauthorized enrollment and access.

Useful 0 Not Useful 0