What is GHSA-c7pm-q6w7-5993?

GHSA-c7pm-q6w7-5993 is a security advisory published by GitHub Security Advisories with Medium severity. The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed...

Which CVE IDs does GHSA-c7pm-q6w7-5993 cover?

GHSA-c7pm-q6w7-5993 covers the following CVE IDs: CVE-2026-12274. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c7pm-q6w7-5993?

GHSA-c7pm-q6w7-5993 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-c7pm-q6w7-5993MediumCVSS 6.5

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed...

Vendor

GitHub Security Advisories

Published

July 13, 2026

Last Modified

July 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-12274 →

📋 Description

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12274
https://wpscan.com/vulnerability/c3d98ead-a4f4-48fd-bf9c-4fa91c5681d7
https://github.com/advisories/GHSA-c7pm-q6w7-5993