WordPress News: Two Plugin RCE Flaws Patched (Week of 15 September 2026)

This week's news comes down to one simple truth we tell clients all the time: most of the real risk on a WordPress site lives in the plugins, not in WordPress itself. Two widely used plugins, an online course builder and a geolocation tool, both shipped critical security patches in the last few days. Alongside that, WooCommerce quietly floated a change to its minimum PHP requirement that store owners should be aware of, even though nobody needs to touch anything yet.

Update Tutor LMS today if you run an online course or membership site

On September 11, 2026, Wordfence disclosed a critical vulnerability in Tutor LMS, tracked as CVE-2026-78175 with a CVSS score of 8.8, affecting all versions up to 4.0.7. The flaw sits in how the plugin handles a withdrawal form field. Wordfence's advisory explains that any logged-in user, even one with the lowest "subscriber" access level, can chain the bug into full remote code execution when the plugin's monetization feature and open account registration are both switched on, which is a common setup for course sites that let students and instructors sign themselves up. The vendor has already patched this in version 4.0.8.

What this means for you: if you or your developer run Tutor LMS, update to 4.0.8 or later today. This isn't one to leave for your next scheduled maintenance window, especially if your site allows open registration and you sell courses through it. Our guide to WordPress security best practices covers the basics of keeping plugin access locked down between patches like this one.

A smaller plugin, GEO my WP, also needs a patch

Also disclosed on September 11, Wordfence reported an unauthenticated Local File Inclusion vulnerability in GEO my WP, a location and store-locator plugin, rated 7.5 (High) and affecting versions up to 4.5.5.3. The issue lets an attacker, without needing to log in at all, trick the plugin into loading and running arbitrary PHP files on your server. In certain hosting setups that can escalate all the way to remote code execution. Patchstack's vulnerability database lists the same flaw and confirms a fix landed in version 4.5.5.4.

What this means for you: if your site uses GEO my WP for a store locator, real estate map, or "find a location near you" feature, update now. It's a smaller, less headline-grabbing plugin than Tutor LMS, which is exactly why it's easy to overlook during a routine update pass. It's also a good prompt to check that your backups are actually current and restorable, not just running. Our backups done right guide walks through what that should look like in practice.

WooCommerce wants to drop old PHP versions, but not yet

WooCommerce's engineering team proposed a change on September 8 to raise the plugin's minimum PHP requirement to PHP 8.1, starting with WooCommerce 11.5, currently targeted for January 2027. This would end support for PHP 7.4 and PHP 8.0, both of which stopped receiving security fixes from the PHP project years ago. Nothing changes today, and WooCommerce has been clear that stores on older PHP versions won't be force-upgraded. They'll simply stay on their current WooCommerce release until the store's PHP version is updated.

What this means for you: there's nothing to do right now, but it's worth asking your host what PHP version your store is actually running. If it's 7.4 or 8.0, you're already going without PHP-level security patches, regardless of what WooCommerce eventually decides. When you do upgrade PHP, test it on a staging site first so you can confirm your theme and extensions still behave before touching the live store.

This week's pattern is a familiar one for anyone who has run WordPress sites for a while: the plugins doing the heavy lifting are where the real risk sits, not WordPress core itself. Even the Death Star had a small, overlooked flaw that brought the whole thing down, and these two vulnerabilities work the same way: a minor feature nobody thinks twice about, exploited by someone who went looking. If tracking patches like these every week isn't something you want to keep doing yourself, a maintenance plan handles the updates and monitoring automatically, so you find out about issues like these from us, not from a defaced homepage.

May the Code Be With You.