PHP Object Injection in Tutor LMS Plugin for WordPress

Tutor LMS, a popular eLearning solution for WordPress, contains a critical vulnerability (CVE-2026-78175) affecting all versions up to and including 4.0.7. The vulnerability exists within the 'tutor_save_withdraw_account' AJAX handler, which fails to perform necessary capability or role checks. While the handler relies on a nonce, it incorrectly processes the 'withdraw_method_field' parameter by passing user-supplied input through 'esc_sql()'. This function introduces HMAC placeholders that, upon storage and subsequent retrieval, cause a discrepancy in serialized string length declarations. By providing crafted POST data, an attacker can trigger an 'unserialize()' operation on malformed data, leading to object injection. This permits the execution of a POP chain using 'GuzzleHttp\Cookie\FileCookieJar', effectively allowing an attacker to achieve remote code execution by writing arbitrary content to a file. The vulnerability is accessible to authenticated users with subscriber-level access and can be exploited by unauthenticated attackers if site registration is enabled and the monetization feature is active.

Attack Chain

1. Attacker identifies a WordPress site running Tutor LMS <= 4.0.7 with monetization features enabled.
2. Attacker registers as a student or teacher if user registration is enabled, or uses existing low-privileged credentials.
3. Attacker crafts a malicious payload containing a serialized PHP object designed to utilize the 'GuzzleHttp\Cookie\FileCookieJar' POP chain.
4. Attacker sends an HTTP POST request to the 'wp-admin/admin-ajax.php' endpoint with the 'action' set to 'tutor_save_withdraw_account'.
5. The server-side code processes the 'withdraw_method_field' parameter, triggering the length discrepancy issue during the 'update_user_meta' operation.
6. Upon metadata retrieval, the application calls 'unserialize()' on the malformed input.
7. The deserialization process executes the POP chain, resulting in arbitrary file write capabilities.
8. Attacker writes a PHP webshell to a publicly accessible directory to achieve remote code execution.

Impact

Successful exploitation allows unauthenticated or low-privileged attackers to achieve remote code execution on the WordPress host. This grants full control over the web application, facilitating data exfiltration, defacement, or lateral movement within the hosting environment. Thousands of WordPress installations utilizing this eLearning plugin are potentially affected if the monetization feature is configured.

Recommendation

1. Update Tutor LMS to version 4.0.8 or later immediately to apply the patch for CVE-2026-78175.
2. Disable public user registration on WordPress sites if not strictly necessary until the update is applied.
3. Temporarily disable the monetization feature in Tutor LMS to mitigate the attack vector.
4. Review server logs for anomalous POST requests to 'admin-ajax.php' containing highly encoded or serialized-looking strings.