Critical Vulnerability Identified in Tutor LMS Plugin
Over 100,000 WordPress websites employing the Tutor LMS e-learning plugin have been rendered vulnerable due to a severe remote code execution (RCE) flaw, which could enable low-privileged users to seize control of affected servers.
This vulnerability was unearthed on August 23, 2026, by Wordfence Argus, an AI-driven vulnerability detection agent, and subsequently corroborated by the Wordfence Threat Intelligence team.
Designated with a CVSS score of 8.8, the flaw arises from an authenticated PHP object injection sequence, ultimately permitting arbitrary code execution.
Tutor LMS is extensively utilized for developing WordPress-based educational platforms, online course offerings, and student-management systems.
Pivotal to note is that numerous installations facilitate unrestricted student registrations, resulting in a negligible authentication threshold for exploiting this vulnerability.
An assailant could feasibly create a standard student account, procure a valid frontend nonce, and activate the vulnerable AJAX functionality.
The compromised element lies within the plugin’s withdrawal-account management protocol, specifically the tutor_save_withdraw_account AJAX handler.
While this endpoint necessitates a valid nonce, it lacks adequate checks for capabilities or roles.
Wordfence pointed out that the nonce is accessible to authenticated users via frontend scripts, thereby allowing any logged-in subscriber to interact with the handler.
The attack vector emanates from the insecure handling of withdrawal form data manipulated by the attacker.
The plugin processes input values through WordPress’s esc_sql() function before storing them with update_user_meta().
However, employing esc_sql(), designed for database query escaping, on data subsequently serialized for metadata storage introduces a perilous serialization-length discrepancy.
Internally, WordPress substitutes percent characters with a placeholder token during SQL escaping.
This inflated value is serialized with its augmented length, yet the placeholder is reverted to a solitary percent character prior to being written to the database.
Tracked as CVE-2026-78175, this vulnerability impacts Tutor LMS versions 4.0.7 and earlier, but has been rectified in version 4.0.8.
Assessment of the Tutor LMS Vulnerability
The database can store serialized strings whose declared length is greater than their true length.
Data controlled by the attacker flows through$_POST['withdraw_method_field'][$method], which is retrieved on line 204 via tutor_utils()->avalue_dot().
Subsequently, when WordPress unserializes the malformed metadata, PHP may access data beyond the anticipated string boundary, leading back to attacker-controlled data.
Researchers indicated that the POST field names manipulated by the attacker allowed for the injection of a crafted serialized object stream, transforming the corruption primitive into PHP object injection.
Such a vulnerability can be activated after the malicious metadata has been stored.
A further request to the same handler might trigger WordPress to retrieve and unserialize the previously saved user metadata whilst checking for modifications.
This payload could also be engaged when Tutor LMS retrieves withdrawal data, even through account settings or withdrawal-related dashboard pages.
Wordfence researchers delineated a plausible property-oriented programming chain involving the plugin’s bundled PayPal Composer autoloader and Guzzle’s FileCookieJar class.
This sequence may induce PHP to write attacker-controlled content to a user-specified file path upon the object’s destruction.
If successfully executed, an attacker could inscribe a PHP payload into a web-accessible uploads directory and execute operating system commands with the web server’s privileges.
Themeum recognized the report on August 24 and subsequently released Tutor LMS version 4.0.8 on September 10.
This update implements an instructor-role verification to the withdrawal-account endpoint, removes the hazardous esc_sql() processing, validates withdrawal methods, and constrains submitted fields to a trusted whitelist defined by the plugin.
Wordfence Premium, Care, and Response clients received a firewall rule on August 25, while free Wordfence users are slated to receive the same protection on September 24.
Though this firewall rule serves as a beneficial compensating control, administrators should not consider it a substitute for patching.
| Component | Details |
|---|---|
| Plugin | Tutor LMS – E-learning and online course solution |
| CVE | CVE-2026-78175 |
| Vulnerability | Authenticated PHP Object Injection leading to RCE |
| Severity | CVSS 8.8 High |
| Affected versions | Tutor LMS 4.0.7 and earlier |
| Fixed version | Tutor LMS 4.0.8 |
| Required access | Subscriber-level account or higher |
| Additional condition | Monetization feature enabled; open registration may create an effective unauthenticated path |
WordPress administrators are strongly urged to promptly upgrade Tutor LMS to version 4.0.8 or later, reassess the necessity of public registration, and audit recently created subscriber accounts along with any unexpected files within wp-content/uploads.
Site proprietors should also scrutinize web-server logs for anomalous authenticated AJAX requests targeting tutor_save_withdraw_account.
Organizations operating exposed e-learning platforms ought to contemplate resetting credentials for suspicious accounts, reviewing user metadata pertaining to Tutor LMS withdrawal configurations, and executing a compromise assessment if the plugin remained unpatched following public disclosure.
Source link: Gbhackers.com.
