CVE-2026-0953 - Vulnerability Analysis

Overview

Tutor LMS Pro WordPress plugin <= 3.9.5 contains an authentication bypass caused by failure to verify email matches OAuth token in Social Login addon, letting unauthenticated attackers log in as any user including admins.

Severity & Score

Impact

Unauthenticated attackers can log in as any user, including administrators, leading to full account takeover.

Mitigation

Update to the latest version beyond 3.9.5.

References

• https://tutorlms.com/releases/id/393/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92a120ac-66ae-4678-a87a-e62da885d50b?source=cve
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tutor-pro/tutor-lms-pro-395-authentication-bypass-via-social-login

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 10, 2026

🚨 CRITICAL: CVE-2026-0953 impacts all versions of themeum Tutor LMS Pro for WordPress. Flawed Social Login lets attackers bypass authentication using valid OAuth tokens + victim’s email. Admin accounts at risk. Patch or restrict access! https://radar.offseq.com/threat/cve-2026-0953-cwe-287-improper-authentication-in-t-965fa126 #OffSeq #WordPress #Infosec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner