CVE-2026-12274: The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post

The Tutor LMS WordPress plugin before version 3.9.13 has a security flaw where it doesn't properly check if a user has permission to edit a post before allowing them to overwrite it. This means any authenticated user with instructor-level access (a regular teacher account) can take over and edit any post or page on the website, including those belonging to administrators, because the plugin only checks an unrelated identifier instead of verifying actual permissions.