Tutor LMS Plugin Vulnerability Exposes 100,000 WordPress Sites to Remote Code Execution
A critical PHP object injection vulnerability in the Tutor LMS WordPress plugin, affecting over 100,000 sites, allows authenticated users to achieve remote code execution.
Wordfence researchers have discovered a critical PHP object injection vulnerability within the Tutor LMS WordPress plugin, a popular e-learning solution used by over 100,000 websites. The flaw, identified by Wordfence Argus, allows any authenticated attacker with subscriber-level access to execute arbitrary code on the server. This is achieved by exploiting an interaction between WordPress's database abstraction layer and PHP's serialization engine.
The vulnerability, tracked as CVE-2026-78175, resides in the tutor_save_withdraw_account AJAX handler. Crucially, this handler lacks a proper capability or role check, relying only on a nonce that is easily obtainable by any logged-in user. Since many Tutor LMS installations enable open registration for students and teachers, an attacker can register as a subscriber and quickly gain the necessary access to trigger the vulnerability. The exploit chain involves manipulating user meta data, leading to the deserialization of attacker-controlled input and ultimately remote code execution through a known POP chain.
Exploitation requires the plugin's monetization feature to be enabled. The attack vector involves sending specially crafted data through the withdraw_method_field parameter. The plugin's handling of this data, particularly the keys derived from POST field names which are not properly sanitized, allows for an over-read during deserialization. This enables an attacker to inject an arbitrary serialized object stream, which, when processed, leads to the execution of malicious code.
The impact of this vulnerability is significant, potentially allowing attackers to gain full control of a compromised WordPress site. Given the plugin's widespread use in educational platforms, this could lead to data breaches, website defacement, or the use of compromised sites for further malicious activities. The ease of obtaining a valid nonce and the low authentication barrier make this a particularly dangerous flaw.
Wordfence reported the vulnerability to the Tutor LMS developers, Themeum, on August 23, 2026. The Themeum team responded promptly, acknowledging the issue the next day and releasing a patched version, Tutor LMS 4.0.8, on September 10, 2026. Wordfence began protecting its Premium, Care, and Response users with a firewall rule on August 25, 2026, with the free version of Wordfence receiving similar protection on September 24, 2026.
Users of the Tutor LMS plugin are strongly urged to update to version 4.0.8 immediately to mitigate the risk of exploitation. The vulnerability carries a high CVSS score of 8.8, underscoring its severity. This discovery highlights the ongoing threat posed by vulnerabilities in popular WordPress plugins and the importance of proactive security research and timely patching.
The vulnerability is a complex chain involving multiple components and an obscure interaction within WordPress core. The technical analysis reveals how attacker-controlled data flows through the tutor_save_withdraw_account handler, bypassing security checks and ultimately leading to the execution of a PHP Object Injection exploit. The use of a bundled third-party library's destructor method is key to achieving remote code execution.
This incident serves as a stark reminder for WordPress site administrators to regularly update their plugins and themes, and to maintain a robust security posture. The discovery by Wordfence Argus, an AI research agent, also points to the increasing role of artificial intelligence in identifying sophisticated security threats.