Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
Published: 2026-09-12
Score: 8.8 High
EPSS: 1.1% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Based on the description, the Tutor LMS plugin contains a PHP Object Injection flaw that allows an attacker to craft manipulated serialized data. The flaw occurs in the withdraw endpoint, where untrusted POST data is serialized and stored in user meta without proper validation, leading to deserialization of attacker‑supplied objects. Exploiting this weakness can result in remote code execution through the GuzzleHttp\\Cookie\\FileCookieJar chain loaded via spl_autoload_register. The vulnerability addresses CWE-502.

Affected Systems

The flaw affects the Tutor LMS – eLearning and online course solution plugin released by Themeum. All releases up to and including version 4.0.7 are impacted, while newer releases are presumed to contain a patch.

Risk and Exploitability

Based on the description, it is inferred that the likely attack vector requires an authenticated user with subscriber-level access or another role that can invoke the withdrawal AJAX endpoint. An unauthenticated attacker may achieve the same if user registration is enabled and the monetization feature is active. The vulnerability carries a CVSS score of 8.8, classifying it as high severity, and an EPSS score of < 1%, indicating a low likelihood of current exploitation. This CVE is not listed in the CISA KEV catalog. If the conditions are met, the attacker can trigger the malicious object chain via the withdrawal API and achieve remote code execution on the WordPress server.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Tutor LMS to a version newer than 4.0.7 that addresses this issue.
  • Disable the withdrawal or monetization features if they are not required for your site.
  • Restrict the withdrawal API to administrator roles or remove the capability checks for lower‑privileged users.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Themeum
Themeum tutor Lms – Elearning And Online Course Solution
Wordpress
Wordpress wordpress
Vendors & Products Themeum
Themeum tutor Lms – Elearning And Online Course Solution
Wordpress
Wordpress wordpress

Sat, 12 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
Title Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Themeum Tutor Lms – Elearning And Online Course Solution
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-15T14:01:12.024Z

Reserved: 2026-08-23T15:39:15.798Z

Link: CVE-2026-78175

cve-icon Vulnrichment

Updated: 2026-09-15T13:26:21.918Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T08:16:24.507

Modified: 2026-09-15T15:17:21.707

Link: CVE-2026-78175

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:45:18Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data