A critical vulnerability, identified as CVE-2026-16759, in the Themeum Tutor LMS WordPress plugin was reportedly exploited on the same day it was publicly disclosed. The vulnerability, which affects versions of the plugin up to 2.6.1, allows unauthenticated attackers to perform arbitrary file uploads, potentially leading to remote code execution.
The vulnerability was assigned a CVSS score of 9.8, indicating a critical severity. It stems from insufficient validation of file types during the upload process within the plugin's media handling functionality. Specifically, the `tutor_upload_file` function, which is accessible to unauthenticated users, failed to properly sanitize uploaded files, allowing malicious scripts to be introduced.
According to reports, evidence of exploitation emerged on August 28, 2026, the same day the CVE record was published. This rapid exploitation timeframe highlights the immediate threat posed by such vulnerabilities once details become public. One commercial research catalog, VulnCheck KEV, listed the vulnerability as exploited on this date, though it is not yet included in the CISA KEV or EUVD lists.
Themeum, the developer of Tutor LMS, released a patch in version 2.6.2 of the plugin to address the vulnerability. Users are strongly advised to update their installations immediately to mitigate the risk of compromise. The update introduces more robust file type validation and sanitization checks to prevent unauthorized file uploads.
Tutor LMS is a popular WordPress plugin used for creating and managing online learning platforms, with a significant number of active installations. The widespread use of the plugin means that a large number of websites could be at risk if they have not yet applied the security update.
The swift exploitation of CVE-2026-16759 underscores a recurring pattern where attackers quickly weaponize newly disclosed vulnerabilities. This emphasizes the importance of prompt patching by administrators and continuous monitoring for suspicious activity, especially for publicly accessible web applications.
