Filtered by tag: lms plugin security × Clear
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Matched: WordPress
A PHP Object Injection vulnerability (CVE-2026-78175, CVSS 8.8) in the Tutor LMS WordPress plugin affects 100,000+ sites running versions 4.0.7 and earlier. Subscriber-level users can achieve remote code execution by exploiting a serialization length-desync bug caused by misuse of esc_sql(), combined with a GuzzleHttp POP chain. Open registration makes exploitation easy. A patch is available in version 4.0.8, released September 10, 2026.