CVE-2026-78175 Overview
The Tutor LMS – eLearning and online course solution plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 4.0.7. The flaw resides in the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. Authenticated attackers with subscriber-level access can achieve remote code execution by triggering the GuzzleHttp\Cookie\FileCookieJar POP chain. When user registration is enabled and the monetization feature is active, the vulnerability becomes reachable via an unauthenticated pathway. The vulnerability is classified under [CWE-502] Insecure Deserialization.
Critical Impact
Authenticated users with minimal privileges can write attacker-controlled content to arbitrary filenames on the server, resulting in remote code execution.
Affected Products
- Tutor LMS WordPress plugin versions up to and including 4.0.7
- WordPress installations with the monetization feature enabled
- WordPress installations permitting open user registration for students and teachers
Discovery Timeline
- 2026-09-12 - CVE-2026-78175 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-78175
Vulnerability Analysis
The tutor_save_withdraw_account AJAX handler lacks any capability or role check and relies solely on a nonce for access control. Attacker-supplied values pass through esc_sql(), which replaces every % character with a 66-byte HMAC placeholder token before the data is serialized and stored via update_user_meta(). When the meta is later retrieved, WordPress collapses the placeholder back to a single % character. This leaves serialized string length declarations 65 bytes greater than the actual content.
Because array keys originate from entirely unescaped POST field names, the subsequent unserialize() call over-reads into attacker-controlled bytes. This allows injection of an arbitrary serialized object stream into the deserialization process.
Root Cause
The root cause combines three defects: missing authorization enforcement on a sensitive AJAX endpoint, mismatched length accounting between esc_sql() placeholder expansion and serialized string headers, and unsanitized array keys derived from POST field names. Together these produce a deserialization primitive that survives storage and retrieval through update_user_meta().
Attack Vector
An attacker submits a crafted POST request to the tutor_save_withdraw_account handler with a manipulated withdraw_method_field value. The stored serialized blob is later deserialized, triggering the GuzzleHttp\Cookie\FileCookieJar property-oriented programming (POP) chain. The chain is reachable through the spl_autoload_register loader in TUTOR\RestAPI, which loads the plugin's bundled PayPal Composer autoloader. The POP chain writes attacker-controlled content to an attacker-specified filename, achieving remote code execution when a PHP file is dropped into a web-accessible location.
See the Wordfence Vulnerability Analysis and the WordPress Tutor RestAPI Code for the vulnerable code paths.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-78175
Indicators of Compromise
- POST requests to admin-ajax.php with action=tutor_save_withdraw_account originating from low-privileged or newly registered accounts.
- Presence of the string GuzzleHttp\Cookie\FileCookieJar or O: serialized object markers inside wp_usermeta values tied to withdraw method fields.
- Unexpected PHP files appearing in plugin, uploads, or theme directories following requests to the Tutor LMS withdraw endpoint.
Detection Strategies
- Inspect wp_usermeta rows for serialized payloads whose declared string lengths do not match their actual content lengths.
- Alert on invocations of spl_autoload_register triggered by the Tutor RestAPI class outside expected request flows.
- Baseline the file inventory of the Tutor plugin directory and monitor for new or modified .php files.
Monitoring Recommendations
- Enable WordPress audit logging for AJAX actions and correlate tutor_save_withdraw_account calls with subsequent file writes.
- Monitor web server access logs for POST bodies containing encoded object injection markers such as O: or long HMAC-like placeholder strings.
- Track user registration spikes when monetization is enabled, as new subscriber accounts provide the required privilege level.
How to Mitigate CVE-2026-78175
Immediate Actions Required
- Update the Tutor LMS plugin to a version newer than 4.0.7 that includes the fix from the WordPress Tutor Changeset.
- Audit all user accounts with subscriber-level access or higher and remove unrecognized accounts created since the plugin was installed.
- Review wp_usermeta for suspicious serialized payloads and clean any records associated with the withdraw method field.
Patch Information
The vendor addressed the vulnerability in the Tutor LMS release referenced in changeset 3690454. Site administrators should apply the update through the WordPress plugin manager. Review the patch notes in the WordPress Tutor Changeset to confirm the fix is present.
Workarounds
- Disable the Tutor LMS monetization feature until the patch is applied, which removes the exploitable withdraw workflow.
- Disable open user registration to eliminate the unauthenticated exploitation pathway.
- Restrict access to admin-ajax.php for the tutor_save_withdraw_account action using a web application firewall rule.
# Example WAF rule to block the vulnerable AJAX action
# Deny POST requests targeting the vulnerable handler
SecRule REQUEST_METHOD "@streq POST" \
"chain,id:1026078175,phase:2,deny,status:403,\
msg:'Block Tutor LMS CVE-2026-78175 exploitation attempt'"
SecRule ARGS:action "@streq tutor_save_withdraw_account"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
