Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
CVE-2026-78175 (CVSS 8.8) affects Tutor LMS versions 4.0.7 and earlier, a WordPress e-learning plugin used on more than 100,000 sites. The tutor_save_withdraw_account AJAX handler verifies only a nonce and not user roles, allowing subscriber-level users to trigger PHP object injection that writes arbitrary files and can achieve remote code execution. Wordfence's Argus research agent identified the flaw on August 23, 2026, with a firewall rule available August 25 and a free rule scheduled for September 24. Version 4.0.8, released September 10, 2026, adds instructor-only permission checks and removes the unsafe data processing; no in-the-wild exploitation has been reported.
- Subscriber-level access suffices; open-registration sites let attackers create accounts via student sign-up forms.
- PHP object injection in the withdrawal-account feature enables arbitrary file writes and web server command execution.
- Wordfence released a free firewall rule September 24; updating to 4.0.8 remains essential.
- Admins should review open registration, inactive accounts, uploads folders, and server logs for compromise signs.
- CVEs
- CVE-2026-78175
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78175 | PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7) | 8.8 | — |
From the original article
3 min read at cybersecuritynews.com
A high-severity flaw in the Tutor LMS WordPress plugin could let a low-privileged user take control of an affected server. The issue affects more than 100,000 sites that use the e-learning plugin, particularly installations that allow visitors to register as students. Tracked as CVE-2026-78175, the vulnerability is rated 8.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.