Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability

More than 100,000 WordPress sites using the Tutor LMS e-learning plugin were exposed to a high-severity remote code execution vulnerability that could allow low-privileged users to take control of vulnerable servers.

The vulnerability was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research agent, and validated by the Wordfence Threat Intelligence team.

Wordfence assigned the issue a CVSS score of 8.8, reflecting the risk created by an authenticated PHP object injection chain that can end in arbitrary code execution.

Tutor LMS is widely used to build WordPress-based education portals, online course platforms, and student-management sites.

Crucially, many deployments permit open student registration, meaning the vulnerability’s subscriber-level authentication requirement may represent only a minimal barrier.

An attacker could potentially create a standard student account, obtain a valid frontend nonce, and invoke the vulnerable AJAX functionality.

The vulnerable component is the plugin’s withdrawal-account management workflow, specifically the tutor_save_withdraw_account AJAX handler.

While the endpoint required a valid nonce, it did not enforce a capability or role check.

Wordfence noted that the nonce was exposed to authenticated users through frontend scripts, enabling any logged-in subscriber to access the handler.

The attack chain stems from unsafe handling of attacker-controlled withdrawal form data.

The plugin processed submitted values through WordPress’s esc_sql() function before storing them with update_user_meta().

While esc_sql() is intended for database-query escaping, its use on data later serialized for metadata storage created a dangerous serialization-length mismatch.

WordPress internally replaces percent characters with a placeholder token during SQL escaping.

The inflated value is serialized with its expanded length, but the placeholder is restored to a single percent character before the database write occurs.

The vulnerability, tracked as CVE-2026-78175, affects Tutor LMS versions 4.0.7 and earlier and has been fixed in version 4.0.8.

Tutor LMS Vulnerability

As a result, the database can contain serialized strings whose declared length is larger than their real length.

Attacker-controlled data flows in through $_POST['withdraw_method_field'][$method], retrieved on line 204 via tutor_utils()->avalue_dot().

When WordPress later unserializes the malformed metadata, PHP can read beyond the expected string boundary into attacker-controlled data.

Researchers said the attacker-controlled POST field names enabled injection of a crafted serialized object stream, turning the corruption primitive into PHP object injection.

The vulnerability can be triggered after the malicious metadata has been stored.

A second request to the same handler may cause WordPress to retrieve and unserialize the previously saved user metadata while checking for changes.

The payload could also be triggered when Tutor LMS retrieves withdrawal data, including through account settings or withdrawal-related dashboard pages.

Wordfence researchers identified a viable property-oriented programming chain involving the plugin’s bundled PayPal Composer autoloader and Guzzle’s FileCookieJar class.

The chain can cause PHP to write attacker-controlled content to an attacker-selected file path when the object is destroyed.

In a successful scenario, an attacker could write a PHP payload to a web-accessible uploads directory and execute operating-system commands under the web server’s privileges.

Themeum acknowledged the report on August 24 and issued Tutor LMS version 4.0.8 on September 10.

The update adds an instructor-role check to the withdrawal-account endpoint, removes the unsafe esc_sql() processing, validates withdrawal methods, and restricts submitted fields to a trusted whitelist defined by the plugin.

Wordfence Premium, Care, and Response customers received a firewall rule on August 25. Free Wordfence users are scheduled to receive the same protection on September 24.

The firewall rule is valuable as a compensating control, but administrators should not treat it as a replacement for patching.

WordPress administrators should immediately upgrade Tutor LMS to version 4.0.8 or later, review whether public registration is necessary, and audit recently created subscriber accounts and unexpected files under wp-content/uploads.

Site owners should also inspect web-server logs for unusual authenticated AJAX requests targeting tutor_save_withdraw_account.

Organizations running exposed learning platforms should consider resetting credentials for suspicious accounts, reviewing user metadata associated with Tutor LMS withdrawal settings, and conducting a compromise assessment if the plugin remained unpatched after public disclosure.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC