High-Severity RCE Vulnerability in Tutor LMS Exposes 100,000+ WordPress Sites
A critical remote code execution (RCE) vulnerability in the Tutor LMS plugin used by over 100,000 WordPress sites for e-learning and course management was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research tool. The flaw, tracked as CVE-2026-78175 (CVSS 8.8), allows authenticated attackers with subscriber-level access to execute arbitrary code on vulnerable servers.
Vulnerability Details
The issue stems from an authenticated PHP object injection chain in the plugin’s withdrawal-account management workflow, specifically the tutor_save_withdraw_account AJAX handler. While the endpoint required a valid frontend nonce, it lacked proper role or capability checks, enabling any logged-in user including those with minimal privileges to exploit it.
The attack leverages a serialization-length mismatch caused by improper use of WordPress’s esc_sql() function on user-submitted withdrawal form data. When processed, the function replaces percent characters with placeholders, inflating the serialized string’s declared length. Upon unserialization, PHP reads beyond the expected boundary, allowing attackers to inject malicious objects.
A viable property-oriented programming (POP) chain was identified, involving Tutor LMS’s PayPal Composer autoloader and Guzzle’s FileCookieJar class. In a successful exploit, an attacker could write a PHP payload to a web-accessible directory (e.g., wp-content/uploads) and execute OS commands under the web server’s privileges.
Impact & Exploitation Conditions
- Affected Versions: Tutor LMS 4.0.7 and earlier
- Fixed Version: 4.0.8 (released September 10, 2026)
- Required Access: Subscriber-level account (or higher)
- Additional Risk: Many Tutor LMS deployments allow open student registration, lowering the barrier for unauthenticated attackers.
Exploitation could occur via:
- A malicious withdrawal request storing corrupted metadata.
- A second request triggering unserialization of the payload.
- Dashboard interactions (e.g., account settings or withdrawal pages).
Mitigation & Response
Themeum, the plugin’s developer, patched the flaw in version 4.0.8 by:
- Adding an instructor-role check to the vulnerable endpoint.
- Removing unsafe
esc_sql()processing. - Validating withdrawal methods and restricting fields to a trusted whitelist.
Wordfence released a firewall rule on August 25 for Premium, Care, and Response customers, with free users receiving protection on September 24. While the rule provides temporary mitigation, patching remains critical.
Recommended Actions for Site Owners
- Upgrade immediately to Tutor LMS 4.0.8 or later.
- Review public registration settings to limit unauthorized account creation.
- Audit subscriber accounts and user metadata for suspicious activity.
- Inspect web server logs for unusual AJAX requests targeting
tutor_save_withdraw_account. - Check
wp-content/uploadsfor unexpected files that may indicate compromise.
The vulnerability underscores the risks of improper input handling and privilege escalation in widely used WordPress plugins, particularly in environments with open registration.
Source: https://gbhackers.com/tutor-lms-vulnerability/
WordPress Plugins cybersecurity rating report: https://www.rankiteo.com/company/wordpress-plugins
"id": "WOR1789727048",
"linkid": "wordpress-plugins",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '100,000+ WordPress sites',
'industry': 'E-Learning, WordPress Plugins',
'name': 'Themeum (Tutor LMS Plugin)',
'type': 'Software Vendor'}],
'attack_vector': 'Authenticated PHP Object Injection',
'customer_advisories': 'Public advisory released by Wordfence with mitigation '
'steps.',
'date_detected': '2026-08-23',
'date_publicly_disclosed': '2026-08-23',
'date_resolved': '2026-09-10',
'description': 'A critical remote code execution (RCE) vulnerability in the '
'Tutor LMS plugin used by over 100,000 WordPress sites for '
'e-learning and course management was discovered. The flaw, '
'tracked as CVE-2026-78175 (CVSS 8.8), allows authenticated '
'attackers with subscriber-level access to execute arbitrary '
'code on vulnerable servers via an authenticated PHP object '
'injection chain in the plugin’s withdrawal-account management '
'workflow.',
'impact': {'brand_reputation_impact': 'Potential reputational damage for '
'affected sites',
'operational_impact': 'Potential unauthorized code execution on '
'vulnerable servers',
'systems_affected': '100,000+ WordPress sites using Tutor LMS'},
'investigation_status': 'Resolved',
'lessons_learned': 'The vulnerability underscores the risks of improper input '
'handling and privilege escalation in widely used '
'WordPress plugins, particularly in environments with open '
'registration.',
'post_incident_analysis': {'corrective_actions': ['Added instructor-role '
'check to the vulnerable '
'endpoint',
'Removed unsafe `esc_sql()` '
'processing',
'Validated withdrawal '
'methods and restricted '
'fields to a trusted '
'whitelist'],
'root_causes': ['Improper use of `esc_sql()` '
'function on user-submitted '
'withdrawal form data',
'Lack of proper role or capability '
'checks in the '
'`tutor_save_withdraw_account` '
'AJAX handler',
'Serialization-length mismatch '
'leading to PHP object injection']},
'recommendations': ['Upgrade immediately to Tutor LMS 4.0.8 or later.',
'Review public registration settings to limit '
'unauthorized account creation.',
'Audit subscriber accounts and user metadata for '
'suspicious activity.',
'Inspect web server logs for unusual AJAX requests '
'targeting `tutor_save_withdraw_account`.',
'Check `wp-content/uploads` for unexpected files that may '
'indicate compromise.'],
'references': [{'source': 'Wordfence Argus'}],
'response': {'communication_strategy': 'Public disclosure and advisory by '
'Wordfence',
'containment_measures': 'Firewall rule by Wordfence to mitigate '
'exploitation',
'enhanced_monitoring': 'Audit subscriber accounts and user '
'metadata for suspicious activity',
'remediation_measures': 'Patch released in Tutor LMS 4.0.8 '
'(September 10, 2026)',
'third_party_assistance': 'Wordfence (firewall rule released on '
'August 25, 2026)'},
'title': 'High-Severity RCE Vulnerability in Tutor LMS Exposes 100,000+ '
'WordPress Sites',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-78175 (CVSS 8.8)'}