The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Tutor Lms Plugin | — | Update tutor-lms plugin to version 3.9.13, or a newer patched version | Jul 31, 2026 | Jun 22, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub