CVE-2026-0953: Tutor LMS Pro Auth Bypass Vulnerability

CVE-2026-0953 Overview

CVE-2026-0953 is a critical authentication bypass vulnerability affecting the Tutor LMS Pro plugin for WordPress. The vulnerability exists in the Social Login addon component, where the plugin fails to properly verify that the email address provided in authentication requests matches the email associated with the validated OAuth token. This oversight allows unauthenticated attackers to log in as any existing user on the WordPress site, including administrators, by supplying a valid OAuth token from their own account combined with a victim's email address.

Critical Impact

Unauthenticated attackers can gain administrative access to WordPress sites running vulnerable versions of Tutor LMS Pro by exploiting improper OAuth token validation in the Social Login feature.

Affected Products

• Tutor LMS Pro plugin for WordPress versions up to and including 3.9.5
• WordPress sites with the Social Login addon enabled
• All installations using OAuth-based authentication through the plugin

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-0953 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-0953

Vulnerability Analysis

This authentication bypass vulnerability falls under CWE-287 (Improper Authentication). The core issue lies in the Social Login addon's handling of OAuth authentication requests. When a user authenticates via social login providers (such as Google or Facebook), the plugin validates that the OAuth token is legitimate but fails to verify that the email address submitted with the authentication request actually corresponds to the authenticated OAuth identity.

In a properly implemented OAuth flow, the application must extract the user's email directly from the validated token claims and use that email to identify the user. However, the vulnerable implementation accepts an email address as a separate parameter from the client-side request and uses it to look up and authenticate users without confirming it matches the token's associated identity.

This architectural flaw transforms a legitimate OAuth token from one account into an authentication mechanism for any account on the system, completely bypassing the intended authentication controls.

Root Cause

The root cause is improper validation logic in the Social Login authentication handler. The plugin validates the OAuth token's authenticity (confirming it was issued by a legitimate provider) but fails to bind the authenticated session to the identity within that token. Instead, it trusts a user-supplied email parameter to determine which account to authenticate, creating a disconnect between OAuth validation and user identification.

Attack Vector

This is a network-based attack requiring no privileges or user interaction. An attacker needs only to:

1. Obtain a valid OAuth token from their own social login account (e.g., Google or Facebook)
2. Identify the email address of a target user (administrator) on the vulnerable WordPress site
3. Submit an authentication request containing their valid OAuth token paired with the victim's email address
4. The plugin validates the OAuth token as legitimate and then authenticates the attacker as the victim

The attacker's OAuth token, combined with the victim's email address, allows them to bypass authentication and gain full access to the victim's account, including administrative accounts.

Detection Methods for CVE-2026-0953

Indicators of Compromise

• Authentication logs showing social login events where the authenticated email differs from expected patterns
• Multiple successful social login authentications to different accounts originating from the same IP address or OAuth provider account
• Administrative accounts showing social login activity when administrators typically use standard WordPress credentials
• Unusual session creation patterns indicating account access from unexpected geographic locations following social login events

Detection Strategies

• Implement logging that captures both the OAuth token's claimed email and the email used for user lookup, then alert on mismatches
• Monitor for authentication events where the same OAuth provider account ID authenticates as multiple different WordPress users
• Review access logs for administrative actions following social login authentications
• Deploy WordPress security plugins capable of detecting anomalous authentication patterns

Monitoring Recommendations

• Enable detailed authentication logging in WordPress to capture social login events with full request context
• Set up alerts for administrative account access via social login mechanisms
• Monitor for privilege escalation activities following authentication bypass attempts
• Implement real-time log analysis to detect multiple authentication attempts with varying email addresses from single sources

How to Mitigate CVE-2026-0953

Immediate Actions Required

• Update Tutor LMS Pro plugin to a version newer than 3.9.5 immediately
• If unable to update immediately, disable the Social Login addon until patching is possible
• Audit administrative and privileged accounts for unauthorized access or changes
• Review WordPress user accounts for suspicious modifications or newly created admin users
• Force password resets and session invalidation for all administrative accounts

Patch Information

The vulnerability has been addressed by the Tutor LMS development team. Organizations should update to the latest patched version of Tutor LMS Pro as documented in the Tutor LMS Release Note. For additional technical details regarding the vulnerability, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Disable the Social Login addon entirely until the plugin can be updated to a patched version
• Restrict social login functionality to non-privileged user roles if possible
• Implement additional authentication factors for administrative accounts independent of the plugin
• Use a Web Application Firewall (WAF) to monitor and filter suspicious authentication requests to the social login endpoints
• Consider temporarily removing the Tutor LMS Pro plugin if no immediate business need requires its functionality