Kiran 
A newly disclosed vulnerability in Tutor LMS, one of WordPress’s most popular e-learning plugins with over 100,000 active installations, could let a low-privilege user seize complete control of a website’s server.
Security researchers at Wordfence say the flaw, tracked as CVE-2026-78175 and rated 8.8 (High) on the CVSS scale, was uncovered by their AI-driven research system, Wordfence Argus, on August 23, 2026.
The vulnerability lives inside Tutor LMS’s instructor payout feature, specifically the tutor_save_withdraw_account function that handles withdrawal method settings.
100K WordPress Sites at Risk
The core problem is twofold: the function checks only for a valid security nonce rather than verifying that the requester actually holds instructor privileges, and it mishandles user input in a way that corrupts how PHP stores serialized data.
Because Tutor LMS sites typically allow open student self-registration, an anonymous visitor can create a subscriber-level account in seconds and immediately obtain the nonce needed to reach this weak point.
From there, a technical quirk involving WordPress’s SQL-escaping function causes stored data to become misaligned when it’s later read back and deserialized, opening the door to what’s known as PHP Object Injection.
Attackers can exploit this desynchronization to smuggle in malicious serialized objects. The exploit chain doesn’t stop there.
Tutor LMS bundles a copy of the GuzzleHttp PHP library for PayPal payment processing, and the plugin’s own class-loading mechanism can be tricked into loading that library on demand.
Once loaded, an attacker-crafted object mimicking Guzzle’s cookie-jar component can trigger a destructor method that writes attacker-controlled content, including PHP code, directly to a file inside the website’s uploads folder.
Visiting that planted file executes commands on the server, giving the attacker a functioning web shell and full remote code execution.
Tutor LMS developer Themeum responded quickly once Wordfence submitted disclosure details through its Vulnerability Management Portal.
The vendor acknowledged the report within a day and shipped version 4.0.8 on September 10, 2026 just over two weeks after initial notification.
The patch closes the hole from multiple angles rather than relying on a single fix. It adds a genuine instructor-capability check after nonce verification, removes the problematic escaping function that caused the serialization mismatch, and replaces free-form input handling with a strict whitelist that accepts only predefined field names.
Security researchers note that any one of these three changes alone would have blocked exploitation, making the combined patch a strong example of defense-in-depth remediation.
Wordfence Premium, Care, and Response subscribers received a firewall rule blocking known exploit attempts on August 25, 2026, while users of the free Wordfence version won’t get equivalent protection until September 24, 2026 — leaving a window of exposure for unpatched, unprotected sites.
Given the low bar for exploitation on sites with open registration enabled, administrators running Tutor LMS should treat this as an urgent update. Upgrading to version 4.0.8 or later immediately removes the vulnerable code path and is the only complete safeguard against this attack chain.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
