CVE-2026-78175: Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through escsql(), which replaces every % character with a 66-byte HMAC placeholder token before the data is serialized and stored via updateusermeta(); when the meta is later retrieved, the placeholder is collapsed back to a single %, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, unserialize() over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the GuzzleHttp\Cookie\FileCookieJar POP chain, reachable via the splautoloadregister loader in TUTOR\RestAPI which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tutor LMS – eLearning and online course solution plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.0.7 - Configuration
Patch the Tutor LMS plugin so the tutor_save_withdraw_account AJAX handler enforces capability/role checks (not only a nonce) and does not unserialize attacker-controlled data derived from unescaped POST field names (e.g., prevent object injection via withdraw_method_field / serialized user meta handling).
WordPress Tutor LMS (tutor_save_withdraw_account AJAX handler) withdraw_method_field (parameter handling) = Remove/stop trusting untrusted user-controlled input and ensure capability/role checks are enforced before processing; do not allow untrusted POST field names to reach unserialize(). - Compensating control
If monetization is not required, disable the Monetization feature in Tutor LMS to prevent the object injection pathway from being reachable (vulnerable path requires monetization to be enabled).
- Compensating control
If user registration is not required to be open to unauthenticated users, restrict or disable registration in WordPress (the unauthenticated pathway exists when user registration is enabled).
- Operational
After applying the plugin fix, review and rotate any secrets/credentials that could have been exposed if remote code execution was achieved (e.g., WordPress keys, database credentials, and any server credentials used by the plugin/server).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with subscriber-level access or higher. The vulnerable AJAX handler does not enforce a capability or role check beyond relying on a nonce.
What access and conditions are required for exploitation?
The attacker must be able to authenticate and submit crafted data to the tutor_save_withdraw_account AJAX handler through the withdraw_method_field parameter. No user interaction is required.
Are installations running Tutor LMS 4.0.7 affected?
Yes. The issue affects Tutor LMS versions up to and including 4.0.7.
What is the potential impact if exploitation succeeds?
A successful attacker can inject an arbitrary serialized object stream and use the described POP chain to achieve remote code execution on the server. This can affect confidentiality, integrity, and availability.