A high-severity vulnerability in the WordPress Tutor LMS plugin (CVE-2026-78175) affects over 100,000 sites and allows attackers to gain full server control through low-privilege user accounts. Small business owners using this e-learning plugin must apply updates immediately to prevent compromise.
A.I. Ron's cyber news update for September 18, 2026 covers six critical security issues affecting small businesses:
1. **WordPress Tutor LMS Vulnerability (CVE-2026-78175)**: A high-severity flaw with an 8.8/10 severity score affects over 100,000 WordPress sites using the Tutor LMS e-learning plugin. The vulnerability allows low-privileged users to gain full server control, particularly affecting sites with student registration enabled. Immediate updates are required.
2. **MikroTick MikroTik Router Attack**: A critical vulnerability chain allows attackers to gain complete administrative control of MikroTik RouterOS devices without passwords. Six vulnerabilities were disclosed by Polish security researchers on September 5, 2026. Internet-exposed SSH connections are particularly at risk. Router owners must update firmware immediately.
3. **Brevo Supply Chain Attack**: Hackers compromised a Brevo API key to inject malicious scripts into 100,000+ websites using the marketing platform. This supply chain attack demonstrates how third-party services can become entry points for compromise. Brevo users should audit their sites for unexpected scripts.
4. **ChatGPT Phishing Campaign**: Scammers are sending fake ChatGPT subscription renewal emails since early May to steal OpenAI credentials. These phishing messages claim payment failures or expiring subscriptions. Stolen accounts can expose business conversations and enable further attacks. Multi-factor authentication and direct website access are recommended.
5. **Chrome 153 Security Update (CVE-2026-93374 and others)**: Google patched 16 vulnerabilities including two critical memory-safety flaws in Dawn and WebGL. Version 153.0.8010.52/53 is rolling out to Windows, macOS, and Linux. The critical flaws allow remote code execution through malicious websites.
6. **Android Security State Libraries**: Google released new tools allowing apps to verify if devices are missing critical security patches, providing better visibility than monthly Security Patch Levels. This is particularly important for BYOD policies and compliance in finance and healthcare sectors.
Why does a WordPress plugin vulnerability matter for your small business?
The Tutor LMS vulnerability (CVE-2026-78175, severity 8.8/10) bypasses normal access controls, letting attackers escalate privileges to administrator level without credentials. For professional services firms and manufacturers running WordPress sites with customer portals, this means your customer data, employee information, and business records sit exposed if the plugin remains unpatched. One attacker gaining server access can install backdoors, steal databases, or redirect customers to phishing pages. Your immediate action: check your WordPress plugins now (Dashboard > Plugins). Search for Tutor LMS. If installed, update to the patched version within 24 hours. If you host with a managed provider, contact them to confirm the update is applied.
Key takeaways
- CVE-2026-78175 in Tutor LMS plugin allows full server takeover from low-privilege accounts; update within 24 hours.
- Six critical MikroTik RouterOS vulnerabilities also disclosed this week; firmware updates required for internet-exposed devices.
- Brevo supply chain compromise injected malware into 100,000+ websites via compromised API key; audit your site for unauthorized scripts.
- Chrome 153 patches 16 flaws including critical remote code execution bugs; update browsers across all devices.
Frequently asked questions
How do I know if my WordPress site uses the vulnerable Tutor LMS plugin?
Log into your WordPress dashboard, go to Plugins, and search for 'Tutor LMS' or 'Tutor'. If it appears in your installed plugins list, your site is affected. Check the version number next to the plugin name and compare it to the patched version listed in the official update notice.
What happens if I don't update the WordPress plugin vulnerability?
An attacker can register as a student, then use the flaw to escalate their account to full administrator access. From there, they can steal customer data, install malware, lock you out of your own site, or redirect visitors to phishing pages. This exposure creates liability under data protection laws.
Can a WordPress plugin vulnerability affect my backups?
If an attacker gains server access, they can modify or delete your backup files if they are stored on the same server. Use an offsite backup solution (cloud storage, external drive not connected to your network) to ensure you can recover even after a breach.
Should I disable Tutor LMS while waiting for an update?
Yes, if you cannot update immediately, deactivate the plugin (do not delete it yet, in case you need it later). This blocks the attack vector. Reactivate it only after you have applied the official patch and tested it on a staging site.
Sources
- https://cybersecuritynews.com/tutor-lms-flaw/
- https://cybersecuritynews.com/mikrotrick-attack/
- https://www.securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/
- https://cybersecuritynews.com/chatgpt-subscription/
- https://cybersecuritynews.com/chrome-153-patches-16-security-vulnerabilities/
- https://cybersecuritynews.com/android-apps-check-security-patches/