Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
1
Stories per day · 30 days
3 RSS
3 stories, newest first · one card per story
Stories tagged #plugin-vulnerability
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence found a PHP object injection flaw in Tutor LMS letting subscriber-level attackers achieve remote code execution on 100,000+ WordPress sites.
WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover
A critical unauthenticated flaw in the User Profile Builder WordPress plugin exposed roughly 40,000 sites to administrator account takeover.