Security Alert Summary
The Tutor LMS – eLearning and online course solution plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2026-78175) in its AJAX handler that can be reached via the withdraw_method_field parameter. The handler lacks capability or role checks and uses unsafe handling of serialized data, enabling authenticated users with subscriber-level access or higher — and in some configurations unauthenticated users when registration and monetization are enabled — to inject crafted serialized objects that can lead to remote code execution by leveraging a Guzzle cookie file POP chain.
CVE Details
- CVE ID: CVE-2026-78175
- Affected component: Tutor LMS – eLearning and online course solution plugin for WordPress
- Affected versions: All versions up to and including 4.0.7
- Published: September 12, 2026 at 8:16:24 AM
- Last modified: September 12, 2026 at 8:16:24 AM
- CVSS v3.1: Base Score 8.8 – HIGH
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW
- User Interaction: NONE
- Scope: UNCHANGED
- Impact: Confidentiality: HIGH, Integrity: HIGH, Availability: HIGH
- Authentication / Requirements: Exploitable by authenticated users with subscriber-level access and above; an unauthenticated pathway exists when user registration is enabled. The monetization feature must be enabled for the monetization-related flow referenced.
- Weakness: CWE-502 (Deserialization of Untrusted Data)
Technical Details
The vulnerability arises in the tutor_save_withdraw_account AJAX handler via the withdraw_method_field parameter. The handler performs no capability or role check and relies solely on a nonce. User-supplied values are passed through esc_sql(), which replaces each percent sign (%) with a 66-byte HMAC placeholder token before data is serialized and stored via update_user_meta(). When the meta is later retrieved, the placeholder is collapsed back to a single percent sign, creating a mismatch between serialized length declarations and actual content size.
Because array keys can originate from unescaped POST field names, unserialize() can over-read into attacker-controlled bytes. An attacker can craft an arbitrary serialized object stream that triggers the GuzzleHttp\Cookie\FileCookieJar POP chain. The chain is reachable through the plugin’s autoloading pathway: the spl_autoload_register loader in TUTOR\RestAPI loads the plugin’s bundled PayPal Composer autoloader, allowing attacker-controlled data to be written to an attacker-specified filename and resulting in remote code execution on the server when the chain is triggered.
The description indicates an unauthenticated pathway is present when site user registration is enabled, which is commonly used for students and teachers. The flow also requires the plugin’s monetization feature to be enabled.
How This Could Impact Your Website
Consider a typical small education site with a site owner, internal staff (instructors), and external users (students or contractors). If the site allows user registration and monetization, a low-privilege registered user or a newly registered account could submit specially crafted form data to the withdrawal AJAX endpoint. That data can be serialized into user meta and later deserialized in a way that allows execution of a Guzzle POP chain, potentially letting an attacker write files or execute code on the server.
Practical consequences include exposure of user-related data stored in meta, the potential for server-side code execution, and an increased risk of targeted phishing if attacker access reveals internal email addresses or other contact information. These risks make it important to review who can register and what features are enabled.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially for contributor- and subscriber-level accounts.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Disable or remove unused or unmaintained plugins, and disable registration if it is not needed.
- Monitor site activity and logs for unusual behavior, including unexpected file writes or changes to user meta.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/RestAPI.php#L190
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L204
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L213
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L217
- https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L44
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3690454%40tutor&new=3690454%40tutor
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077d56-11e7-4e74-abe0-63e81db67be3?source=cve
