Loading story…
A high-severity vulnerability, CVE-2026-78175 (CVSS 8.8), in the Tutor LMS WordPress plugin can let authenticated subscriber-level users execute code on affected servers. Versions 4.0.7 and earlier inadequately protect a withdrawal-account AJAX handler: it validates a nonce but does not enforce proper authorization, allowing crafted data to be stored in user records and later unsafely deserialized. Exploitation chains WordPress serialization-length desynchronization with a bundled Guzzle FileCookieJar deserialization gadget chain; sites with open student registration are particularly exposed because attackers can create the required account, provided monetization is enabled.
Themeum addressed the issue in Tutor LMS 4.0.8 by restricting the handler to instructors, removing unsafe esc_sql() usage, validating withdrawal methods, and allowlisting form-field keys. Organizations using the plugin should update immediately and review user accounts, upload directories, administrator accounts, and web-server logs for suspicious activity. No active exploitation has been confirmed publicly.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Wordfence published its advisory describing CVE-2026-78175, which affects Tutor LMS versions 4.0.7 and earlier and can allow an authenticated subscriber to achieve remote code execution.
Themeum released Tutor LMS 4.0.8, fully remediating CVE-2026-78175. The update adds an instructor authorization check, removes unsafe processing, validates withdrawal methods, and restricts accepted form fields.
A firewall rule intended to protect against CVE-2026-78175 was made available to certain users as an additional mitigation layer.
Themeum acknowledged the report concerning CVE-2026-78175 in the Tutor LMS WordPress plugin.
Wordfence's Argus research agent identified CVE-2026-78175, a high-severity PHP object-injection flaw in Tutor LMS, and the Wordfence Threat Intelligence team validated the finding the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities were disclosed across popular **WordPress plugins**, creating pathways to account takeover, privilege escalation, and sensitive data exposure. The most severe issue, **CVE-2025-15521** in *Academy LMS* (<= `3.5.0`), allows **unauthenticated administrator account takeover** because the plugin’s password update flow relies on a **publicly exposed WordPress nonce** as authorization rather than validating user identity; *Wordfence* reported observing exploitation attempts in the wild and blocking dozens of attacks in a 24-hour period. Additional disclosures affect other plugins with different exploitation prerequisites and impacts. **CVE-2026-0726** in *Nexter Extension – Site Enhancements Toolkit* (<= `4.4.6`) is an **unauthenticated PHP object injection** via `nxt_unserialize_replace`, but it requires a usable **POP chain** from another installed plugin/theme to reach file deletion, data theft, or code execution. **CVE-2025-15347** in *Creator LMS* (<= `1.1.12`) enables **authenticated (Contributor+)** attackers to update arbitrary WordPress options due to a missing capability check, potentially leading to privilege escalation or site compromise. **CVE-2025-14977** in *Dokan* (<= `4.2.4`) is an **IDOR** in the `/wp-json/dokan/v1/settings` REST endpoint that lets **authenticated (Customer+)** users read/modify other vendors’ settings, including changing PayPal payout emails and accessing bank/payment details, enabling fraud and sensitive information disclosure.
Jun 29, 2026
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to **1.11.38**, including **CVE-2026-33698**, an unauthenticated remote code execution issue tied to the `main/install/` directory, and **CVE-2026-31939**, a path traversal flaw in `main/exercise/savescores.php` that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if `main/install/` remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server. The second flaw allows user-controlled input from `$_REQUEST['test']` to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under **CWE-552**, **CWE-22**, and **CWE-73**, and both were addressed in **Chamilo LMS 1.11.38** through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Jun 29, 2026
Multiple high-severity flaws in WordPress plugins exposed sites to account takeover and, in one case, possible remote code execution. In **Users Manager PN**, tracked as `CVE-2026-4003`, a missing authorization check in the `userspn_ajax_nopriv_server()` handler let unauthenticated attackers overwrite arbitrary user metadata through the `userspn_form_save` AJAX action. Because the required `userspn-nonce` was reportedly exposed on public pages, attackers could abuse the bug with a single crafted request to modify profiles and potentially seize control of administrator accounts. The issue affected versions through `1.1.15` and was reportedly fixed in `1.1.20`. Two additional vulnerabilities were disclosed in **WP Captcha PRO** affecting versions through `5.38`. `CVE-2026-5415` allowed **Subscriber-level users or higher** to generate temporary login links for arbitrary accounts because the `ajax_run_tool()` AJAX handler checked only a nonce and not user capabilities, enabling authentication bypass and administrator takeover. Separately, `CVE-2026-5411` allowed authenticated low-privilege users to upload attacker-controlled files by poisoning license metadata and abusing `sync_cloud_protection()` to download and extract content into a web-accessible uploads directory; if PHP execution was possible and `allow_url_fopen` was enabled for remote retrieval, the flaw could be escalated to **remote code execution** via a webshell.
Jun 29, 2026