A Tutor LMS flaw lets low-privileged users execute code remotely, risking server takeover on 100,000+ WordPress sites.