Hundreds of Thousands of WordPress Sites at Risk After Tutor LMS Remote Code Execution Flaw Discovered

A critical remote code execution (RCE) flaw affecting the Tutor LMS e‑learning plugin has put more than 100,000 WordPress sites in jeopardy, security researchers reported on August 23, 2026. The vulnerability, classified as high severity, enables users with limited privileges to execute arbitrary code on servers running the vulnerable plugin, potentially allowing full control of the host environment.

Tutor LMS, a widely adopted learning management system for WordPress, integrates directly with the platform's core to deliver courses, quizzes, and student tracking. Because WordPress powers roughly 40 percent of all websites, plugins like Tutor LMS are common attack vectors. In this case, the flaw stems from insufficient validation of user‑supplied data, which can be leveraged to inject malicious commands that run with the web server’s permissions.

The issue was initially uncovered by the independent security group GBHackers, who disclosed their findings publicly after confirming that the exploit could be triggered by accounts that do not have administrative rights. Their analysis showed that an attacker could, for example, upload a PHP payload through a seemingly benign form field, then execute it to gain persistent access to the underlying server.

Experts warn that the scale of the exposure is concerning: any site that has installed Tutor LMS and not yet applied a security update is potentially vulnerable. While the exact number of compromised sites is not yet known, the figure of over 100,000 installations highlights the widespread reliance on the plugin. Site owners are being urged to review their plugin versions, apply any patches released by the developers, and audit user permissions to limit low‑level accounts.

The discovery underscores a broader challenge for the WordPress ecosystem, where third‑party extensions often outpace the core platform’s security review processes. Security analysts recommend that administrators adopt a layered defense strategy—regularly updating plugins, employing web application firewalls, and monitoring for anomalous activity. As the community awaits further guidance from the Tutor LMS maintainers, the incident serves as a reminder that even popular, well‑maintained plugins can harbor serious vulnerabilities that require swift remediation.