Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+

Executive Summary

A critical authentication bypass vulnerability (CVE-2026-0953) has been discovered in the Tutor LMS Pro plugin for WordPress, affecting over 30,000 active installations. The flaw resides in the plugin's Social Login addon and carries a CVSS score of 9.8 — the second-highest possible rating.

The vulnerability allows an unauthenticated attacker to bypass authentication entirely and log in as any registered user, including site administrators. The root cause is a failure to validate that the email address submitted in a social login request matches the email associated with the verified OAuth token.

Organizations running Tutor LMS Pro version 3.9.5 or earlier with the Social Login feature enabled should update to version 3.9.6 immediately or disable the Social Login addon until patched.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Tutor LMS Pro Social Login addon integrates with OAuth providers (Google, Facebook, etc.) to allow users to sign in via social accounts. During the authentication flow, the plugin receives an OAuth token from the provider along with a user-supplied email address.

The critical flaw: the plugin does not verify that the email in the login request matches the email encoded within the validated OAuth token.

An attacker can therefore:

1. Obtain a valid OAuth token for their own social account
2. Submit that token alongside a different user's email (e.g., the site admin's email)
3. The plugin validates the OAuth token as legitimate, then authenticates the request as the email-specified user — without any cross-check

This is a classic OAuth token/email mismatch vulnerability.

Attack Flow

1. Attacker creates a social account (e.g., Google) and obtains a valid OAuth token
2. Attacker enumerates or guesses admin/user email address on target WordPress site
3. Attacker sends crafted social login POST request:
   - oauth_token: [attacker's valid token]
   - email: [victim's email, e.g., admin@targetsite.com]
4. Plugin validates OAuth token signature — token is valid (it's the attacker's own)
5. Plugin retrieves WordPress user by the supplied email — returns admin account
6. Plugin creates authenticated session for admin — no password required
7. Attacker is logged in as site administrator with full WordPress control

Exploitation Conditions

• Tutor LMS Pro version 3.9.5 or earlier must be installed and active
• The Social Login addon must be enabled (default in most Tutor LMS Pro installations)
• The attacker needs a valid OAuth token from any supported provider (trivial to obtain)
• The attacker needs a valid email address registered on the site (can be guessed, found in leaks, or via WP user enumeration)

Impact Assessment

Immediate Remediation

Step 1: Update Tutor LMS Pro to 3.9.6

# Via WP-CLI
wp plugin update tutor-pro
 
# Verify installed version
wp plugin get tutor-pro --field=version
# Expected: 3.9.6 or higher

Or update through the WordPress admin panel: Plugins > Installed Plugins > Tutor LMS Pro > Update Now.

Step 2: Disable Social Login if Update Is Not Immediately Possible

1. Navigate to WordPress Admin > Tutor LMS > Settings > Addons
2. Locate Social Login
3. Toggle OFF and save settings

Alternatively, deactivate the entire Tutor LMS Pro plugin if the site does not depend on it critically.

Step 3: Audit for Compromise

# Check for recently created admin accounts
wp user list --role=administrator --fields=user_login,user_email,user_registered
 
# Review recent login events (if audit log plugin is active)
wp db query "SELECT user_login, user_email, user_registered FROM wp_users WHERE user_registered > DATE_SUB(NOW(), INTERVAL 7 DAY);"
 
# Search for recently modified PHP files (potential backdoors)
find /path/to/wordpress/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -not -path "*/cache/*" -type f
 
# Check active plugins for unauthorized additions
wp plugin list --status=active

Step 4: Harden WordPress Authentication

# Force password reset for all administrator accounts
wp user list --role=administrator --format=ids | xargs -I {} wp user update {} --user_pass="$(openssl rand -base64 24)"
 
# Regenerate WordPress secret keys
wp config shuffle-salts
 
# Invalidate all existing sessions
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"

Detection Indicators

Post-Remediation Checklist

1. Update Tutor LMS Pro to version 3.9.6 or later
2. Disable Social Login addon until patched if update is delayed
3. Audit all administrator accounts — remove any unauthorized entries
4. Reset all admin passwords and regenerate WordPress secret keys
5. Invalidate all active sessions to force re-authentication
6. Scan for webshells and backdoors in wp-content/ directory
7. Review access logs for evidence of prior exploitation
8. Enable two-factor authentication on all administrator accounts
9. Deploy a WAF (Wordfence, Sucuri, Cloudflare) with WordPress rule sets
10. Monitor for re-exploitation until patch is confirmed applied

References

• NVD — CVE-2026-0953
• Malware News — 30,000 WordPress Sites Affected by Tutor LMS Pro Auth Bypass
• Managed-WP — Mitigating Broken Authentication in Tutor LMS Pro
• OffSeq Threat Radar — CVE-2026-0953 Intelligence
• Vulnerability Lookup — CVE-2026-0953