CVE-2026-12271

Medium · 5.4

CVSS

5.4

EPSS

—

Published

Jul 13, 2026

CISA due date

—

The record

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

Affected packages

Ecosystem	Package	Introduced	Fixed