High-Severity RCE Vulnerability in Tutor LMS Exposes 100,000+ WordPress Sites A critical remote code execution (RCE) vulnerability in the Tutor LMS plugin used by over 100,000 WordPress sites for e-learning and course management was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research tool. The flaw, tracked as CVE-2026-78175 (CVSS 8.8), allows authenticated attackers with subscriber-level access to execute arbitrary code on vulnerable servers. ### Vulnerability Details The issue stems from an authenticated PHP object injection chain in the plugin’s withdrawal-account management workflow, specifically the `tutor_save_withdraw_account` AJAX handler. While the endpoint required a valid frontend nonce, it lacked proper role or capability checks, enabling any logged-in user including those with minimal privileges to exploit it. The attack leverages a serialization-length mismatch caused by improper use of WordPress’s `esc_sql()` function on user-submitted withdrawal form data. When processed, the function replaces percent characters with placeholders, inflating the serialized string’s declared length. Upon unserialization, PHP reads beyond the expected boundary, allowing attackers to inject malicious objects. A viable property-oriented programming (POP) chain was identified, involving Tutor LMS’s PayPal Composer autoloader and Guzzle’s FileCookieJar class. In a successful exploit, an attacker could write a PHP payload to a web-accessible directory (e.g., `wp-content/uploads`) and execute OS commands under the web server’s privileges. ### Impact & Exploitation Conditions - Affected Versions: Tutor LMS 4.0.7 and earlier - Fixed Version: 4.0.8 (released September 10, 2026) - Required Access: Subscriber-level account (or higher) - Additional Risk: Many Tutor LMS deployments allow open student registration, lowering the barrier for unauthenticated attackers. Exploitation could occur via: - A malicious withdrawal request storing corrupted metadata. - A second request triggering unserialization of the payload. - Dashboard interactions (e.g., account settings or withdrawal pages). ### Mitigation & Response Themeum, the plugin’s developer, patched the flaw in version 4.0.8 by: - Adding an instructor-role check to the vulnerable endpoint. - Removing unsafe `esc_sql()` processing. - Validating withdrawal methods and restricting fields to a trusted whitelist. Wordfence released a firewall rule on August 25 for Premium, Care, and Response customers, with free users receiving protection on September 24. While the rule provides temporary mitigation, patching remains critical. ### Recommended Actions for Site Owners - Upgrade immediately to Tutor LMS 4.0.8 or later. - Review public registration settings to limit unauthorized account creation. - Audit subscriber accounts and user metadata for suspicious activity. - Inspect web server logs for unusual AJAX requests targeting `tutor_save_withdraw_account`. - Check `wp-content/uploads` for unexpected files that may indicate compromise. The vulnerability underscores the risks of improper input handling and privilege escalation in widely used WordPress plugins, particularly in environments with open registration.