WordPress · Security · Small Business

100,000 WordPress Sites. One Free Student Account. Full Server Access.

Somebody signed up for a free account on your website. That was the whole attack. On more than 100,000 WordPress sites running a plugin called Tutor LMS, a visitor who created a student login could take over the server. Not deface your homepage. Run commands on it. Here is what actually happened, what it costs a business like yours, and the four things to do today.

The Short Answer

Wordfence disclosed a flaw in Tutor LMS, a course plugin on more than 100,000 WordPress sites. It is rated 8.8 out of 10, high severity, and it lets anyone with a subscriber-level account run their own code on your server. Because course sites normally let students sign up themselves, on most affected sites that means anybody. Themeum shipped a fix in version 4.0.8 on September 10, 2026. Update to 4.0.8 or later. If you are on the free version of Wordfence, your firewall rule does not arrive until September 24, 2026.

Source: Wordfence, Chloe Chamberland, September 17, 2026. CVE-2026-78175.

3 Things to Remember

The login bar was a free student account, and course sites hand those out on purpose.

Updating to 4.0.8 closes the door. It does not clean up a break-in that already happened.

You did not install a hole. You installed a course plugin. The hole came with it.

Open student registration is not a misconfiguration on a course site. It is the product.

Anyone Who Could Sign Up Could Take the Server.

The bug lives in the part of Tutor LMS that saves a payout account, the screen an instructor uses to tell you where to send their money.

That screen was supposed to be for instructors. The code never checked. It asked for one thing, a security token, and WordPress prints that token on every page of the site for every logged-in user. So a subscriber had it the second they loaded your homepage.

On a course site, getting to be a subscriber is the easy part. Open student registration is not a misconfiguration on these sites. It is the product. Wordfence says it plainly: because Tutor LMS is built around student enrollment and most installations turn on open registration by default, the bar for an attacker is effectively nothing.

Two conditions had to be true. Registration open, which is normal. And the plugin's monetization feature turned on, which is true for anyone selling a course.

The mistake: you assume "logged-in only" means "safe." It means a spam bot with an email address is inside the fence.

The fix: treat every self-service signup on your site as a stranger with a key. Ask what that key opens.

The payoff: you stop measuring your security by your firewall and start measuring it by what the lowest-privilege account on your site can reach.

The damage parks itself in your database and waits for a normal page load.

The Payload Was a File That Runs Commands, Dropped in Your Uploads Folder.

I will keep the guts short, because the shape is what matters.

The plugin ran your input through a function built for database queries, not for storage. That function swaps every percent sign for a 66-byte safety token. WordPress then strips that token back out on the way into the database. What lands on disk is a saved record that claims to be 71 characters long while actually holding 6.

The next time WordPress reads that record, it reads 65 characters too far, straight into text the attacker also controlled. The attacker put a working instruction there. It runs.

The end of that chain writes a PHP file into wp-content/uploads with contents the attacker picked. After that, anyone who loads that file in a browser is running operating system commands as your web server.

Here is the part that should make your stomach drop. Wordfence notes that simply viewing the withdrawal page sets it off. Nobody has to keep attacking you. The damage is parked in your database waiting for a normal page load.

Nobody has to come back for it. One normal page load and the money starts leaving.

What This Actually Costs a Small Business.

"Remote code execution" means nothing at your kitchen table, so let me translate.

Your customer list is in that database. Names, emails, phone numbers, what they bought. Someone with server access copies it in about a second.

Your mail gets used. A compromised server is a free sending machine. Your domain ends up on spam blocklists, and then your real estimates stop landing in real inboxes. That one takes months to undo.

Google notices before you do. A hacked site gets flagged, and the red warning screen in front of your homepage costs more in a week than the plugin saved you in a year.

Your payment flow becomes theirs. If you take money on the site, someone who can write files can change where the form posts.

And the timeline is not on your side. The patch came out September 10, 2026. Every public advisory is also a map. Paid Wordfence users got a blocking rule on August 25, 2026. Free users get the same rule on September 24, 2026. If you are on the free tier, there is a stretch where the flaw is public and your firewall is not covering it.

The mistake: you treat plugin updates as maintenance you get to the week after next.

The fix: you treat a published high-severity advisory as a fire, because the people reading it are faster than your to-do list.

The payoff: you are patched before the scanners finish writing you down.

Four steps. The first one is checking whether this is even your problem.

Here Is the Fix. Four Steps, Maybe Ten Minutes.

1. Check whether this is even your problem. Log in to your site, go to Plugins, and look for Tutor LMS. Not there? You are done. Close this and go sell something.

2. Read the version number. Anything at 4.0.7 or below is vulnerable. 4.0.8 and above is patched. Update it now, not tonight.

3. If you cannot update this minute, shrink the target. Turn off open user registration under Settings, General. Turn off the plugin's monetization feature. The unauthenticated path needs registration on, and the whole thing needs monetization on. This is a tourniquet, not a fix. Still update.

4. Assume nothing is clean until you look. Updating the plugin does not delete a file an attacker already wrote. Look through wp-content/uploads for .php files, because that folder should hold pictures and documents and almost never code. Check for admin users you do not recognize. Run a malware scan. If you find a file you cannot explain, restore from a backup taken before September, then update.

If you sell courses, run certifications, or onboard new hires through your site, check today. Those are exactly the sites that turn this feature on.

Try it · Find out what your own plugins can do to you

Paste your plugin list. Get a ranked risk read in about a minute.

Plugin risk ranking

You are a WordPress security analyst talking to a business owner, not a developer.

Here is the list of plugins on my site, with version numbers:
[PASTE YOUR PLUGIN LIST]

I run a [TYPE OF BUSINESS] in [YOUR CITY]. My site does [TAKES PAYMENTS / COLLECTS LEADS / BOTH].

Rank these plugins from most dangerous to least, based on what each one can reach if it is broken: my database, my files, my payment flow, my email. For the top 5, tell me in one sentence what a break-in through that plugin would actually cost my business. Then tell me which ones I could delete entirely without losing anything my customers use.

Rules: 5th grade reading level. Short sentences. Plain words only. No jargon without a plain-English translation right after it.

Fill the [brackets] in the chat box before you send. You get a ranked risk list for your actual site, plus the plugins you can just delete.

WordPress is a program that runs other people's programs. That is the deal.

This Is Not a Bad Plugin. This Is the Deal You Signed.

Themeum did fine here. Wordfence told them on August 23, 2026. They acknowledged it the next day and shipped a patch that closed the hole in four separate places. That is a good vendor.

And you still spent this week checking whether strangers had your server.

That is the deal. WordPress is a program that runs other people's programs. Every plugin you add is somebody else's code, with your database and your file system behind it. This one came in through a payout form on a course plugin. Nobody, including the people who wrote it, was thinking about serialized string lengths that day.

Do not let anybody tell you the core is the safe part and plugins are the risk. Last year a WordPress core hole needed no password at all and CISA gave federal agencies three days to patch it. The whole stack is the problem. The plugin pile is just the loudest part of it.

We have built 281 AI JSX sites. There is no plugin folder on any of them, and no WordPress under them either. Not because we are clever. Because you cannot get popped through a door that was never installed.

I am not going to pretend a rebuilt site is unhackable. Nothing is. What I will tell you is that the entire category of problem you just read about, a stranger's PHP running with your file system behind it, is not on the menu when there is no PHP and no plugin folder.

What To Do Next

If you run Tutor LMS, go update it. Right now. This paragraph will wait.

If you are done with a Monday that starts like this, drive one of our builds and see what a site with no plugin folder feels like.

Test Drive a Build →

Balls Out Marketing. No contract, no cost to look.

FAQ

How do I know if my site is affected?

Log in to WordPress, click Plugins, and look for Tutor LMS. If it is not installed, this does not affect you. If it is, check the version. 4.0.7 and below are vulnerable. 4.0.8 and above are patched.

What is CVE-2026-78175?

It is the tracking number for a PHP Object Injection flaw in Tutor LMS that leads to remote code execution. Wordfence rated it 8.8 out of 10, high severity. It affects all versions up to and including 4.0.7.

Can an attacker get in without an account at all?

On many sites, effectively yes. Wordfence describes an unauthenticated pathway when user registration is enabled, which is standard on course sites so students and teachers can sign themselves up. The attacker registers, and they are in.

I updated the plugin. Am I safe now?

You are safe from new attacks through this hole. You are not automatically clean. If someone already exploited it, they may have written a file to your server that the update does not touch. Scan your site and check wp-content/uploads for PHP files.

I use the free version of Wordfence. Am I covered?

Not yet. Wordfence Premium, Care, and Response users got a firewall rule on August 25, 2026. Free users receive the same rule 30 days later, on September 24, 2026. Update the plugin instead of waiting on the rule.

What if I cannot update right now?

Turn off open user registration and turn off the plugin's monetization feature. Both conditions have to be true for the easy attack path to work. Treat that as buying yourself a day, not as a fix.

Should I just stop using WordPress?

That is a bigger call than one plugin. What I will say is that this whole category of problem comes from running other people's PHP with your database behind it. If you are already tired of patch Mondays, it is worth pricing out a site that does not work that way.

Sources cited in this post

Wordfence, Chloe Chamberland, September 17, 2026. "100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS." CVE-2026-78175, CVSS 8.8. wordfence.com
Peter Roesler, Small Business SEO, August 22, 2026. "WordPress Left Your Site Wide Open. The Feds Noticed." (the CISA three-day patch directive) smallbusiness-seo.com