Executive brief
Tutor LMS, a popular learning management system for WordPress, contains a flaw that allows registered users (such as students or subscribers) to bypass comment moderation. An attacker can post comments containing arbitrary links and HTML directly to any page or post on the site without an administrator's approval. This could be used to spread spam, perform SEO poisoning, or redirect users to malicious websites, damaging the site's reputation and user trust.
Technical details
The vulnerability exists in the 'tutor_create_lesson_comment' AJAX handler. The plugin fails to verify if the user has permission to comment on a specific post or if the target post is even a valid lesson. While the handler enforces a nonce check, the required nonce is accessible to any authenticated user with subscriber-level privileges. Because the plugin explicitly sets the comment status to 'approved' upon insertion, attackers can inject arbitrary HTML (subject to wp_kses_post filtering) and hyperlinks into any post ID on the WordPress site, bypassing the standard WordPress comment moderation queue. This issue is resolved in version 3.9.13.
Affected products
- Themeum Tutor LMS before 3.9.13
Timeline
- 2026-06-22: disclosed: Publicly published by WPScan
- 2026-07-13: advisory: NVD publication date
- 2026-07-13: patched: Fixed in version 3.9.13