Critical Tutor LMS flaw exposes 100,000+ WordPress sites to RCE

Key Takeaways

• A critical remote code execution (RCE) vulnerability (CVE-2026-78175) has been discovered in the Tutor LMS WordPress plugin.
• The flaw affects over 100,000 WordPress sites utilizing the e-learning plugin, particularly those with open student registration.
• An attacker with a low-privileged subscriber account can exploit this vulnerability to gain control over the affected web server.
• The vulnerability is rated 8.8 (High) on the CVSS scale.
• A patch is available in Tutor LMS version 4.0.8 and later. All affected sites should update immediately.

A severe security vulnerability in the Tutor LMS WordPress plugin could allow an attacker with minimal privileges to execute arbitrary code on a compromised server. This flaw impacts more than 100,000 websites that rely on the popular e-learning plugin, especially those configured to permit new user registrations, such as for students.

Designated as CVE-2026-78175, this vulnerability carries a high CVSS rating of 8.8 out of 10. All versions of Tutor LMS up to and including 4.0.7 are affected. Exploitation requires only a subscriber-level account. On platforms where visitor registration is enabled, acquiring such an account can be as simple as completing a standard student sign-up form.

Security researchers have confirmed that this bug enables remote code execution, granting an attacker the ability to run commands directly on the web server. This level of access can lead to significant compromise, including data theft, website defacement, or using the site as a launchpad for further malicious activities.

Wordfence said in a report, shared with Cyber Security News (CSN), that its Argus research system first identified the issue on August 23, 2026, with findings validated on the same day. Given that many educational and membership sites routinely allow new user registrations, the potential for widespread exploitation is considerable.

Technical Details of the Tutor LMS Flaw

The vulnerability resides within Tutor LMS’s withdrawal-account functionality. Specifically, the AJAX handler tutor_save_withdraw_account was found to perform an insufficient security check. While it verified the presence of a security nonce, it failed to confirm whether the user initiating the request possessed the necessary permissions or role to access the feature.

An authenticated subscriber could easily obtain a valid nonce by simply navigating to any logged-in page. The core of the flaw involves the insecure handling of data stored within WordPress user records. Maliciously crafted input can corrupt the way PHP processes this saved data, enabling an attacker to inject an unexpected object into the application’s execution flow. This type of weakness is commonly known as PHP object injection, a persistent concern in plugin ecosystems, as evidenced by previous plugin takeover incidents involving unsafe deserialization.

To fully exploit the vulnerability, the attacker must send the crafted request twice or trigger the retrieval of the affected withdrawal information. This action allows the plugin to load a bundled library, which then writes attacker-controlled content to a specified file path. If this path points to a web-accessible directory and the file is a PHP script, subsequent web requests to that file could execute operating system commands under the web server’s privileges.

While there is no current evidence of active exploitation, the ease with which a low-privileged account can be obtained and used to compromise a site makes this a critical concern. Website administrators, particularly those managing membership or course platforms with open registration, should prioritize addressing this vulnerability. It also serves as a reminder that even authenticated access, as seen in past author upload code flaws, can pose significant risks.

What You Should Do

• Update Immediately: The developers of Tutor LMS released version 4.0.8 on September 10, 2026, which fully resolves the vulnerability. All users of Tutor LMS should update their plugin to version 4.0.8 or later without delay.
• Review User Registration: Evaluate whether open registration is truly necessary for your site. If not, consider restricting new user sign-ups.
• Manage User Accounts: Regularly audit and remove inactive user accounts. Ensure that student and instructor roles are assigned strictly based on need and verified credentials.
• Monitor for Suspicious Activity: Check administrator user logs, upload folders, and web-server access logs for any unusual or unauthorized activity.
• Maintain Core WordPress: Keep your WordPress core installation updated. A recent WordPress security update addressed 11 other vulnerabilities, highlighting the importance of comprehensive patching.
• Secure Backups: Implement robust backup procedures. Ensure that backup tools and processes are secure, as vulnerable migration tools can also introduce compromise points.
• Consider WAF Rules: While a protective firewall rule was made available to some users on August 25 and a broader free rule was scheduled for September 24, these should be treated as an additional layer of defense, not a substitute for installing the official patched plugin release.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.