An urgent security vulnerability has been discovered in the Tutor LMS plugin for WordPress that could allow remote code execution (RCE) in more than 100,000 sites. The issue primarily affects versions up through 4.0.7 and stems from unsafe authorization checks in Tutor LMS, particularly in installations where anonymous visitors can register as “students.”
How the Vulnerability Works
Categorized as CVE-2026-78175, this flaw carries a high severity score of 8.8 out of 10. It allows an attacker with only a subscriber role—which on open-registration sites could be easily obtained—to perform actions beyond their privileges. The vulnerable component lies in the plugin’s “withdrawal account” AJAX handler, tutor_save_withdraw_account. While this handler verifies a nonce (a WordPress security token), it fails to check whether the user has the appropriate user role before executing a request.
The vulnerability exploits insecure handling of serialized data stored in user records. By submitting specially crafted input, an attacker can corrupt how PHP loads saved data and insert a malicious object. Doing so twice—or ensuring the withdrawal information is processed—can lead Tutor LMS to use a bundled library to write an attacker-controlled file to a chosen path. If placed in a web-accessible uploads directory, that file could be executed by the server, giving the attacker the ability to run arbitrary OS‐level commands under the web server’s permissions.
Potential Impact
Learning platforms using Tutor LMS often allow user registrations—students, instructors, or customers—making the risk especially high in these setups. A successful attack could enable attackers to inject malicious files, steal sensitive data, modify site content, or use compromised sites to launch further attacks. Although there is no confirmed evidence of active exploitation at present, the low barrier to entry makes the vulnerability especially dangerous for educational platforms and membership sites.
Patch Details & Mitigation Steps
The issue has been fully addressed in Tutor LMS version 4.0.8, released on September 10, 2026. The update adds permission checks so that only instructor-level accounts can access the withdrawal-account request feature, removes the problematic data processing step, restricts acceptable input fields, and validates withdrawal methods. Site administrators are urged to upgrade immediately to v4.0.8 or newer.
Additional protective measures include disabling or limiting open registrations, auditing user roles and active accounts, checking who has administrator access, reviewing upload directories for unexpected files, and scanning server logs for anomalies. Keeping WordPress core up to date is also essential, following recent updates that patched multiple vulnerabilities.
Timeline & Defensive Layers
The flaw was first detected by a research agent on August 23, 2026, and confirmed the same day. A temporary firewall rule was made available to some users by August 25, with plans for a free, broader rule rollout by September 24. But the firewall should be viewed as a stopgap — the patch is the full fix.
What this means: every site using Tutor LMS should assess risk immediately and apply the patch. Sites allowing open sign-ups are especially vulnerable. Going forward, plugin developers, site owners, and platform administrators need to treat even low-privilege access as a possible threat vector. Attackers often exploit these gaps first. Keeping software updated, limiting permissions, and instituting layered defenses are the only reliable way to stay ahead.
