A high-severity flaw in the Tutor LMS WordPress plugin could let a low-privileged user take control of an affected server. The issue affects more than 100,000 sites that use the e-learning plugin, particularly installations that allow visitors to register as students.
Tracked as CVE-2026-78175, the vulnerability is rated 8.8 out of 10 and affects Tutor LMS versions 4.0.7 and earlier. An attacker needs a subscriber-level account, but on sites with open registration, creating that account may be as simple as completing a student sign-up form.
Researchers noted that the bug can lead to remote code execution, meaning an attacker could run commands on the web server.
Wordfence said in a report shared with Cyber Security News (CSN) that its Argus research agent identified the issue on August 23, 2026, and the findings were validated the same day.
The risk is significant because learning sites often accept registrations from students, instructors, and customers. A successful attack could allow an intruder to place a malicious file on the server, steal data, alter site content, or use the compromised website as a foothold for further attacks.
Tutor LMS Flaw
The vulnerable path sits in Tutor LMS’s withdrawal-account feature. The affected AJAX handler, tutor_save_withdraw_account, checked only for a security token called a nonce, but did not verify whether the requester had the proper role to use the feature.
A subscriber could obtain a valid token simply by loading a page while logged in. The flaw stems from unsafe handling of data stored in WordPress user records.
Specially crafted input can corrupt how PHP reads saved data later, allowing the attacker to insert an unexpected object into the process.
This class of weakness is known as PHP object injection, and it remains a serious concern in plugin ecosystems, as seen in earlier plugin takeover risks involving unsafe deserialization.
To trigger the final stage, the attacker sends the crafted request twice or causes the affected withdrawal information to be read. The plugin can then load a bundled library that writes attacker-controlled content to a chosen file path.
If that file is a PHP script placed in a web-accessible uploads directory, later requests could execute operating-system commands under the web server’s permissions.
The report does not claim that this Tutor LMS vulnerability is being actively exploited in the wild. However, its low authentication barrier makes it a priority for administrators, especially on membership or course platforms that let new users register automatically.
Organizations should also remember that authenticated access can still be dangerous, as demonstrated by an author upload code flaw that required a trusted site role.
Patch and Mitigation
The plugin’s developers released Tutor LMS version 4.0.8 on September 10, 2026, to fully address the issue. The update adds an instructor-only permission check, removes the unsafe data-processing step, validates withdrawal methods, and limits fields to an approved list rather than accepting arbitrary user-supplied names.
Administrators running Tutor LMS should update to version 4.0.8 or later without delay. They should also review whether open registration is necessary, remove inactive accounts, and check administrator users, upload folders, and web-server logs for unusual activity.
Maintaining current WordPress core versions matters too, particularly following the recent WordPress security update that fixed 11 additional vulnerabilities.
Where possible, site owners should restrict registration to users who genuinely need accounts and ensure that student and instructor roles are assigned carefully.
Routine backups remain important, but backups should be handled securely because vulnerable migration tools can create another route to compromise, as described in the backup plugin attack chain.
The disclosure timeline shows that a protective firewall rule was made available to certain users on August 25, while the broader free rule was scheduled for September 24. That protection should be treated as an additional layer, not a replacement for installing the patched plugin release.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution appeared first on Cyber Security News.