Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
1
Stories per day · 30 days
3 stories, newest first · one card per story
Stories tagged #tutor-lms
Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
5
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence found a PHP object injection flaw in Tutor LMS letting subscriber-level attackers achieve remote code execution on 100,000+ WordPress sites.