Quick answers
- Is CVE-2026-12274 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12274 being exploited in the wild.
- How severe is CVE-2026-12274?
- Informational severity, with a CVSS score of 8.8, published 13 July 2026.
- Which products and versions are affected?
- Themeum Tutor LMS < 3.9.13.
- Is there a fix for CVE-2026-12274?
- A patch was published on 2026-07-13: Date of NVD publication; plugin fixed in 3.9.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12274 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12274?
- Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the content-builder save handlers of the Tutor LMS plugin for WordPress. The application fails to perform proper authorization checks to ensure the requesting user has permission to edit a specific post ID before executing an overwrite operation. Instead, it validates the request against an unrelated identifier. An authenticated attacker with instructor-level privileges can exploit this to modify the content of any post or page, including administrative pages, effectively gaining full control over the site's content. The issue is resolved in version 3.9.13.
Affected products
- Themeum Tutor LMS < 3.9.13
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory
- 2026-07-13: patched: Date of NVD publication; plugin fixed in 3.9.13