CVE-2026-78175
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The Tutor LMS plugin for WordPress (versions up to and including 4.0.7) is vulnerable to PHP Object Injection via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. The handler lacks capability or role checks, relying solely on a nonce, and passes attacker-supplied values through `esc_sql()`, causing serialized string length mismatches that allow injection of an arbitrary serialized object stream. An authenticated attacker with subscriber-level access or above can achieve remote code execution via the `GuzzleHttp\Cookie\FileCookieJar` POP chain, with an unauthenticated pathway when user registration is enabled.
Risk Assessment
This vulnerability enables remote code execution on the server, potentially leading to full compromise of the WordPress site, data theft, and malware installation. The risk is especially high when user registration and the monetization feature are enabled, as the attack can be performed without authentication.
Recommendation
Immediately update the Tutor LMS plugin to a version newer than 4.0.7 as soon as a fix becomes available. Until then, disable the monetization feature and user registration, and monitor for unusual activity on subscriber accounts.
Other vulnerabilities in Tutor LMS
See all- CVE-2026-15444Medium
The Tutor LMS plugin for WordPress up to version 4.0.1 is vulnerable to generic SQL Injection via the 'coupon_code' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.
- CVE-2026-19092Critical
The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- CVE-2026-18439Medium
The Tutor LMS plugin for WordPress in versions up to and including 4.0.7 is vulnerable to Insecure Direct Object Reference via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values belong to a quiz/topic/course the requester is authorized to manage. An authenticated attacker with Instructor-level access or higher can overwrite content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and delete arbitrary quiz question and answer rows.
- CVE-2026-89333Medium
The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'student_id' parameter. Missing validation on a user-controlled key allows authenticated attackers with subscriber-level access and above to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs.
- CVE-2026-89081Medium
The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link.
- CVE-2026-88944Medium
The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access and above to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires triggering the profile-photo upload flow, creating a Tutor topic reparented to that attachment, then invoking the lesson deletion handler against any target post ID.
- CVE-2026-85572Medium
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content. This allows any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
- CVE-2026-85569High
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential. This allows the holder of a read-only key to act as the administrator account that issued it.
- CVE-2026-16759Medium
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. Missing authorization combined with unsanitized array keys passed to extract() inside tutor_load_template() allow attacker-controlled POST data to overwrite local variables and invoke arbitrary zero-argument PHP functions.
- CVE-2026-19094Medium
The Tutor LMS WordPress plugin before version 4.0.6 does not validate values used to build a database query and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and read question and answer content from courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
Original NVD description (English source)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS