As cited
Copy frozen at (site build).
vulnerabilities
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS affecting over 100,000 WordPress sites that allows authenticated subscribers to achieve remote code execution through a serialization length-desync attack exploiting the plugin's withdraw account feature. The vulnerability (CVE-2026-78175, CVSS 8.8) exists in versions up to 4.0.7 and was patched in version 4.0.8 on September 10, 2026. Because most Tutor LMS installations enable open student registration by default, the effective authentication requirement is low for any site visitor.
Why it matters: WordPress site operators running Tutor LMS versions 4.0.7 or earlier should update to 4.0.8 immediately, as remote code execution is reachable by unauthenticated visitors on sites with open registration and monetization enabled. Wordfence Premium and Care users received firewall rules on August 25, 2026; free users will receive protection on September 24, 2026.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS versions 4.0.7 and earlier that allows authenticated subscribers to achieve remote code execution through a serialization length-desync attack exploiting a bundled GuzzleHttp library. The vulnerability affects over 100,000 WordPress installations and is exploitable by any registered user on sites with open enrollment enabled. Themeum released patched version 4.0.8 on September 10, 2026, addressing the flaw through capability checks, input validation, and key whitelisting.
Why it matters: WordPress site operators running Tutor LMS versions 4.0.7 or earlier face remote code execution risk from any subscriber-level attacker, and must update to version 4.0.8 immediately, particularly on sites with open student registration enabled.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence Argus discovered CVE-2026-78175, a PHP Object Injection vulnerability in Tutor LMS affecting over 100,000 WordPress sites, that allows authenticated subscribers to achieve remote code execution through a serialization length-desync primitive and GuzzleHttp payload chain. The vulnerability exploits an AJAX handler lacking capability checks and misuse of esc_sql() on data destined for update_user_meta(), enabling attackers to inject arbitrary serialized objects that execute when unserialized. Themeum released patched version 4.0.8 on September 10, 2026, implementing a capability check, removing the serialization-corrupting esc_sql() call, and whitelisting array keys to prevent injection.
Why it matters: WordPress site operators running Tutor LMS versions 4.0.7 and earlier must update to 4.0.8 immediately, as the low authentication bar on sites with open student registration makes this a high-priority remote code execution exposure with a CVSS score of 8.8.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
A PHP Object Injection vulnerability in Tutor LMS plugin (versions up to 4.0.7) allows subscriber-level authenticated users to achieve remote code execution through a serialization length desynchronization flaw combined with a gadget chain in the bundled GuzzleHttp library. CVE-2026-78175 affects over 100,000 WordPress sites, and the vendor released patched version 4.0.8 on September 10, 2026, with Wordfence providing firewall protection to premium users on August 25, 2026, and free users on September 24, 2026.
Why it matters: WordPress site operators running Tutor LMS up to version 4.0.7 must update immediately, as sites with open student registration enable unauthenticated attackers to self-register and trigger code execution with low friction.
- Source published
- First seen by Cybersecurity Tracker