CVE-2026-78175

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8

Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw account AJAX handler via the withdraw method field parameter. The handler lacks proper capability or role checks, relying only on a nonce. The issue occurs because esc sql() is misapplied to values stored via update user meta(), causing a serialization length desynchronization where the serialized string length is 65 bytes larger than the actual content. This allows unserialize() to over-read into attacker-controlled POST keys and inject an arbitrary serialized object stream. Attackers with subscriber-level access or higher can trigger the GuzzleHttpCookieFileCookieJar POP chain (Property-Oriented Programming) via the spl autoload register loader in TUTORRestAPI, enabling them to write arbitrary content to a file on the server. This can be exploited by unauthenticated users if user registration and the monetization feature are enabled.

Recommendations Update Tutor LMS to version 4.0.8. Restrict open user registrations and audit user roles to minimize the risk of exploitation. Disable the monetization feature if it is not required.