A significant security flaw has been identified in the Tutor LMS WordPress plugin, potentially allowing unauthorized users to commandeer affected servers. This vulnerability endangers more than 100,000 websites utilizing the e-learning plugin, particularly those permitting visitor registration as students.
Details of the Vulnerability
Identified as CVE-2026-78175, the flaw carries a severity rating of 8.8 out of 10 and impacts Tutor LMS versions 4.0.7 and earlier. Exploitation requires a subscriber-level account, but this can be easily obtained on sites with open registration by completing the student sign-up process.
Experts have warned that this bug could lead to remote code execution, enabling attackers to execute commands on the server. According to a Wordfence report presented to Cyber Security News, the issue was discovered by the Argus research team on August 23, 2026, and confirmed on the same day.
Implications for Affected Sites
The vulnerability lies within the plugin’s withdrawal-account functionality. The AJAX handler, known as tutor_save_withdraw_account, incorrectly relies solely on a security token (nonce) without adequately verifying user permissions. Consequently, a logged-in subscriber can easily obtain a valid token, leading to possible PHP object injection vulnerabilities.
This type of flaw poses serious risks, as it allows crafted input to interfere with PHP’s data handling, potentially enabling the insertion of malicious objects. If executed, this could lead to writing unauthorized content to a specified file path on the server, especially if the file is a PHP script in an accessible directory.
Steps for Mitigation and Prevention
To counteract this threat, the developers released Tutor LMS version 4.0.8 on September 10, 2026, which resolves the issue by implementing strict permission checks and securing data processing. Site administrators are urged to upgrade to this version or later immediately.
Administrators should also assess the necessity of open registration, remove unused accounts, and vigilantly monitor for unusual activity across accounts, upload directories, and server logs. Keeping WordPress core updates current is crucial, given recent security patches addressing other vulnerabilities.
Additionally, site owners are advised to restrict account registrations to essential users and ensure correct role assignments for students and instructors. Regular backups are essential, albeit handled securely to prevent exploitation via backup-related vulnerabilities.
While a protective firewall rule was initially distributed to a select user base on August 25, a broader rollout is planned for September 24. Nonetheless, installing the updated plugin remains the primary protective measure against this vulnerability.
