Tutor LMS

CVE-2026-78175 allows subscriber-level attackers to reach PHP Object Injection and remote code execution in Tutor LMS 4.0.7 and earlier. Update to 4.0.8 or later.

Tutor LMS 4.0.7 and earlier is vulnerable to authenticated PHP Object Injection that can lead to remote code execution. The issue is tracked as CVE-2026-78175 and rated CVSS 8.8 (High). A subscriber-level account is sufficient, which makes the practical barrier low on learning sites that allow public student registration. Tutor LMS 4.0.8 contains the fix.

Table of Contents

Vulnerability summary

Plugin	Tutor LMS – eLearning and online course solution (`tutor`)
Affected versions	4.0.7 and earlier
Fixed version	4.0.8 or later
CVE	CVE-2026-78175
Severity	CVSS 8.8 (High)
Privilege required	Subscriber-level authenticated account
Attack class	PHP Object Injection through a serialization length mismatch, leading to RCE through an available POP chain
Active installations	100,000+
Known exploitation	No in-the-wild exploitation was established by the cited sources

How the PHP Object Injection works

Wordfence attributes the flaw to the tutor_save_withdraw_account AJAX handler and attacker-controlled withdrawal-method fields. The handler checked a nonce but did not enforce an instructor role or an equivalent capability, so a minimally privileged user could reach the vulnerable code.

The affected path passed submitted values through esc_sql() before storing them as user metadata. WordPress temporarily replaces percent characters with a long HMAC placeholder. When this transformation occurred before serialization, the stored string-length declarations could become inconsistent with the value restored later. Attacker-controlled POST field names provided additional bytes beyond the declared boundary.

When the metadata was read back, PHP could over-read the malformed serialized structure into attacker-controlled data and deserialize an injected object stream. Wordfence reports that a property-oriented programming chain ending in the plugin’s bundled Guzzle library could write a PHP file to a web-accessible location, producing remote code execution.

This article intentionally omits a working serialized payload, object chain, and exploit request.

Why subscriber access is a serious condition

Tutor LMS is designed for student enrollment. Many deployments permit visitors to create student accounts, so “Subscriber+” may be only one registration step away from an unauthenticated visitor. Sites that disable public registration still remain exposed to malicious or compromised low-privilege accounts until patched.

The vendor fix

Themeum released Tutor LMS 4.0.8 on September 10, 2026. The remediation adds role validation, removes the unsafe use of esc_sql() from this data path, rejects unexpected array values, sanitizes fields according to type, and builds stored withdrawal data from an approved field definition instead of arbitrary client-supplied keys.

Immediate remediation

Update Tutor LMS to 4.0.8 or later. Update Tutor LMS Pro as well if it is installed.
Until the update is complete, disable public registration or deactivate Tutor LMS if the learning site can tolerate the interruption.
Review student and subscriber accounts created since August 23, 2026, especially accounts with unusual withdrawal-account activity.
Inspect the _tutor_withdraw_method_data user-meta records without printing sensitive values. Very large values or serialized object markers require investigation.
Review access logs for repeated POST requests to admin-ajax.php invoking tutor_save_withdraw_account.
Search upload directories for unexpected executable files and run integrity checks. If evidence is found, isolate the site and treat it as compromised rather than simply deleting one file.

Safe verification commands

wp plugin get tutor --fields=name,status,version,update --format=table
wp plugin update tutor
wp plugin get tutor --field=version
wp user list --role=subscriber --fields=ID,user_login,user_registered --format=table

The following read-only SQL checks report record size and potential serialized-object markers without displaying the stored withdrawal data. Replace wp_usermeta if your database uses another prefix:

SELECT user_id, LENGTH(meta_value) AS stored_bytes
FROM wp_usermeta
WHERE meta_key = '_tutor_withdraw_method_data'
ORDER BY stored_bytes DESC
LIMIT 50;

SELECT user_id, LENGTH(meta_value) AS stored_bytes
FROM wp_usermeta
WHERE meta_key = '_tutor_withdraw_method_data'
  AND meta_value LIKE '%O:%'
ORDER BY stored_bytes DESC;

A match is an investigation cue, not proof of exploitation. Legitimate plugin data may be serialized. Correlate it with account creation dates, application logs, access logs, and filesystem changes.

Temporary hardening

Preventing PHP execution in upload directories can limit a common result of arbitrary file writes. On Apache-compatible hosts, test an equivalent rule in staging before placing it inside wp-content/uploads:

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

This is defense in depth only. It does not remove the PHP Object Injection path or protect other writable directories.

Sources

The vulnerability discovery and technical chain are attributed to Wordfence Argus and the credited Wordfence researchers. WPDeeply is providing defensive remediation guidance, not claiming original discovery.