Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
5
1 stories, newest first · one card per story
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views