Critical WordPress Plugin Flaw Exposes 30,000 Sites to Account Takeovers

Hackers can hijack admin accounts on 30,000 WordPress sites—thanks to a gaping hole in a popular plugin. Did your site just become a target?

, and Administrator

2026 March 15 . 1:09 AM

1 min read

The image shows a word cloud with the words "information security" in different languages,... — The image shows a word cloud with the words "information security" in different languages, emphasizing the importance of security in the business process. The words are arranged in a circular pattern, with the largest words in the center and the smaller words radiating outward. The colors of the words range from light blue to dark blue, creating a visually appealing contrast.

Critical WordPress Plugin Flaw Exposes 30,000 Sites to Account Takeovers

A critical security flaw has been discovered in the popular WordPress plugin Tutor LMS Pro. The vulnerability affects around 30,000 websites and allows attackers to bypass authentication. Without proper credentials, hackers could gain access to any user account—including administrator accounts.

The issue lies in the Social Login add-on of Tutor LMS Pro. All versions up to and including 3.9.5 contain a flaw in the authenticate() function of the TutorPro\SocialLogin\Authentication class. This function fails to check whether the email address provided matches the one verified by the OAuth token.

An attacker can exploit this by logging in with their own social media account and obtaining a valid OAuth token. They can then substitute a victim's email address, gaining full access to that account. The vulnerability poses a severe risk, as compromised administrator accounts could lead to further site takeovers. The developers released a patch on January 30, 2026, in version 3.9.6. Website administrators are strongly advised to update immediately. Additionally, they should review access logs for any unusual login attempts. To reduce exposure, administrator email addresses should also be kept private.

The fix is now available, but sites running older versions remain at risk. Updating to Tutor LMS Pro 3.9.6 or later closes the security gap. Without the patch, attackers could continue exploiting the flaw to hijack accounts.