Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
Wordfence Argus discovered on August 23, 2026, that Tutor LMS 4.0.7 and earlier mishandle esc_sql() on withdrawal-account data stored via update_user_meta(), creating a serialized-length mismatch exploitable for PHP object injection through the tutor_save_withdraw_account AJAX handler. Any subscriber can reach the endpoint because it checks a nonce but no capability, and a property-oriented programming chain using Guzzle's FileCookieJar allows writing a PHP payload to the uploads directory for remote code execution. Themeum shipped version 4.0.8 on September 10 with a role check, input validation, and a field whitelist; Wordfence rated the issue CVSS 8.8.
- CVE-2026-78175 (CVSS 8.8): authenticated PHP object injection leading to RCE in Tutor LMS 4.0.7 and earlier
- Subscriber-level access suffices; open student registration makes many sites practically exposed
- POP chain abuses the bundled PayPal autoloader and Guzzle FileCookieJar to write attacker-controlled files
- Fixed in 4.0.8 on September 10; Wordfence firewall rule available since August 25
- Admins urged to patch, review subscriber accounts, and audit wp-content/uploads
- CVEs
- CVE-2026-78175
- Organizations
- Wordfence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78175 | PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7) | 8.8 | — |
From the original article
3 min read at gbhackers.com
More than 100,000 WordPress sites using the Tutor LMS e-learning plugin were exposed to a high-severity remote code execution vulnerability that could allow low-privileged users to take control of vulnerable servers. The vulnerability was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research agent, and validated by the Wordfence Threat Intelligence team. […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.