CVE-2026-12271

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

Medium · published July 13, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Published
2026-07-13T06:00Z
EPSS history
Timeline
  • 13 JUL 06:00Z
    Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
    cvelistv5