CVE-2026-78175

Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

View on CVE.org
Published Sep 12, 2026 CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

Analysis

AI-generated

Technical impact

Based on the description, the Tutor LMS plugin contains a PHP Object Injection flaw that allows an attacker to craft manipulated serialized data. The flaw occurs in the withdraw endpoint, where untrusted POST data is serialized and stored in user meta without proper validation, leading to deserialization of attacker‑supplied objects. Exploiting this weakness can result in remote code execution through the GuzzleHttp\\Cookie\\FileCookieJar chain loaded via spl_autoload_register. The vulnerability addresses CWE-502.

Affected Systems

The flaw affects the Tutor LMS – eLearning and online course solution plugin released by Themeum. All releases up to and including version 4.0.7 are impacted, while newer releases are presumed to contain a patch.

Risk and Exploitability

Based on the description, it is inferred that the likely attack vector requires an authenticated user with subscriber-level access or another role that can invoke the withdrawal AJAX endpoint. An unauthenticated attacker may achieve the same if user registration is enabled and the monetization feature is active. The vulnerability carries a CVSS score of 8.8, classifying it as high severity, and an EPSS score of &lt; 1%, indicating a low likelihood of current exploitation. This CVE is not listed in the CISA KEV catalog. If the conditions are met, the attacker can trigger the malicious object chain via the withdrawal API and achieve remote code execution on the WordPress server.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Tutor LMS to a version newer than 4.0.7 that addresses this issue.
  • Disable the withdrawal or monetization features if they are not required for your site.
  • Restrict the withdrawal API to administrator roles or remove the capability checks for lower‑privileged users.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Themeum
Themeum tutor Lms – Elearning And Online Course Solution
Wordpress
Wordpress wordpress
Vendors & Products Themeum
Themeum tutor Lms – Elearning And Online Course Solution
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
Title Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Sep 15, 2026, 2:01 PM
Reserved
Aug 23, 2026, 3:39 PM

View source JSON

Updated
Sep 15, 2026, 1:26 PM

JSON

Status
Deferred
Published
Sep 12, 2026, 8:16 AM
Modified
Sep 15, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 6:45 PM

JSON