Wordfence says its Argus research tool found a PHP Object Injection flaw in Tutor LMS, an e-learning plugin active on more than 100,000 WordPress sites, that can let an attacker run code on your server.
What happened
The flaw, tracked as CVE-2026-78175 with a CVSS score of 8.8, sits in the plugin’s tutor_save_withdraw_account function. That function checked for a valid security token but not whether the requester actually had permission to use the feature. Any user with a Subscriber-level account, the lowest access tier in WordPress, can exploit it.
That bar is low in practice. Tutor LMS is built around student enrollment, and most installations leave registration open so students can sign themselves up. Anyone who can reach the site can create a Subscriber account and attempt the exploit.
Wordfence discovered the bug on August 23 and reported it to Tutor LMS developer Themeum the same day. Wordfence Premium, Care, and Response customers received a firewall rule blocking known exploit attempts on August 25. Free Wordfence users get the same protection on September 24, 30 days later. Themeum fixed the flaw in version 4.0.8, which adds an authorization check, removes unsafe processing, and restricts which fields the withdrawal form accepts.
What to do
- Update Tutor LMS to version 4.0.8 or later now.
- If open registration isn’t something your site needs, consider disabling it until you’ve confirmed you’re updated.
- If you run Wordfence Premium, Care, or Response, you’ve been protected by a firewall rule since August 25. Free Wordfence users are covered starting September 24, so updating the plugin itself is your best protection until then.
End of article