Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
CVE-2026-78175 (CVSS 8.8) affects Tutor LMS versions 4.0.7 and earlier, a WordPress e-learning plugin used on more than 100,000 sites. The tutor_save_withdraw_account AJAX handler verifies only a nonce and not user roles, allowing subscriber-level users to trigger PHP object injection that writes arbitrary files and can achieve remote code execution. Wordfence's Argus research agent identified the flaw on August 23, 2026, with a firewall rule available August 25 and a free rule scheduled for September 24. Version 4.0.8, released September 10, 2026, adds instructor-only permission checks and removes the unsafe data processing; no in-the-wild exploitation has been reported.
- Subscriber-level access suffices; open-registration sites let attackers create accounts via student sign-up forms.
- PHP object injection in the withdrawal-account feature enables arbitrary file writes and web server command execution.
- Wordfence released a free firewall rule September 24; updating to 4.0.8 remains essential.
- Admins should review open registration, inactive accounts, uploads folders, and server logs for compromise signs.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-78175 | PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7) Tutor LMS, a WordPress eLearning plugin, suffers from a PHP object injection flaw (CWE-502) in the `tutor_save_withdraw_account` AJAX handler, which accepts attacker-controlled `withdraw_method_field` values with no capability check beyond a nonce and stores them via `update_user_meta()` in a way that corrupts serialized string lengths. An authenticated user with subscriber-level privileges (or an unauthenticated attacker, if open user registration is enabled) who holds a valid nonce can therefore make `unserialize()` over-read into attacker-controlled bytes and inject an arbitrary serialized object. By chaining the plugin's bundled PayPal Composer autoloader with the `GuzzleHttp\Cookie\FileCookieJar` gadget, the attacker achieves remote code execution, writing attacker-controlled content to an attacker-specified filename on the server. All sites running Tutor LMS up to and including version 4.0.7 with the monetization feature enabled are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time. Do: Update Tutor LMS to a release newer than 4.0.7 as soon as a patched version is published (no fixed version number is confirmed in the available data). As interim mitigation, disable the plugin's monetization/withdraw feature, restrict or close open user registration, and review `update_user_meta()`-stored withdraw account data for tampered serialized values. Sites that enabled monetization and registration should also audit for unexpected files written by web-server users during the exposure window. | 8.8 | — |
| large≈100,000+ WordPress installs of Tutor LMS (plugin-directory active-install level), of which a smaller subset |
Full article696 words · extracted from cybersecuritynews.com · click to collapse
A high-severity flaw in the Tutor LMS WordPress plugin could let a low-privileged user take control of an affected server. The issue affects more than 100,000 sites that use the e-learning plugin, particularly installations that allow visitors to register as students.
Tracked as CVE-2026-78175, the vulnerability is rated 8.8 out of 10 and affects Tutor LMS versions 4.0.7 and earlier. An attacker needs a subscriber-level account, but on sites with open registration, creating that account may be as simple as completing a student sign-up form.
Researchers noted that the bug can lead to remote code execution, meaning an attacker could run commands on the web server.
Wordfence said in a report shared with Cyber Security News (CSN) that its Argus research agent identified the issue on August 23, 2026, and the findings were validated the same day.
The risk is significant because learning sites often accept registrations from students, instructors, and customers. A successful attack could allow an intruder to place a malicious file on the server, steal data, alter site content, or use the compromised website as a foothold for further attacks.
Tutor LMS Flaw
The vulnerable path sits in Tutor LMS’s withdrawal-account feature. The affected AJAX handler, tutor_save_withdraw_account, checked only for a security token called a nonce, but did not verify whether the requester had the proper role to use the feature.
A subscriber could obtain a valid token simply by loading a page while logged in. The flaw stems from unsafe handling of data stored in WordPress user records.
Specially crafted input can corrupt how PHP reads saved data later, allowing the attacker to insert an unexpected object into the process.
This class of weakness is known as PHP object injection, and it remains a serious concern in plugin ecosystems, as seen in earlier plugin takeover risks involving unsafe deserialization.
To trigger the final stage, the attacker sends the crafted request twice or causes the affected withdrawal information to be read. The plugin can then load a bundled library that writes attacker-controlled content to a chosen file path.
If that file is a PHP script placed in a web-accessible uploads directory, later requests could execute operating-system commands under the web server’s permissions.
The report does not claim that this Tutor LMS vulnerability is being actively exploited in the wild. However, its low authentication barrier makes it a priority for administrators, especially on membership or course platforms that let new users register automatically.
Organizations should also remember that authenticated access can still be dangerous, as demonstrated by an author upload code flaw that required a trusted site role.
Patch and Mitigation
The plugin’s developers released Tutor LMS version 4.0.8 on September 10, 2026, to fully address the issue. The update adds an instructor-only permission check, removes the unsafe data-processing step, validates withdrawal methods, and limits fields to an approved list rather than accepting arbitrary user-supplied names.
Administrators running Tutor LMS should update to version 4.0.8 or later without delay. They should also review whether open registration is necessary, remove inactive accounts, and check administrator users, upload folders, and web-server logs for unusual activity.
Maintaining current WordPress core versions matters too, particularly following the recent WordPress security update that fixed 11 additional vulnerabilities.
Where possible, site owners should restrict registration to users who genuinely need accounts and ensure that student and instructor roles are assigned carefully.
Routine backups remain important, but backups should be handled securely because vulnerable migration tools can create another route to compromise, as described in the backup plugin attack chain.
The disclosure timeline shows that a protective firewall rule was made available to certain users on August 25, while the broader free rule was scheduled for September 24. That protection should be treated as an additional layer, not a replacement for installing the patched plugin release.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/tutor-lms-flaw/