---
id: CVE-2026-78175
title: >-
  The Tutor LMS – eLearning and online course solution plugin for WordPress is
  vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7
  via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account`
  AJ…
summary: >-
  The Tutor LMS – eLearning and online course solution plugin for WordPress is
  vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7
  via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account`
  AJ…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: themeum
product: Tutor LMS – eLearning and online course solution
affected:
  - tutor_lms_elearning_and_online_course_solution <= 4.0.7
published: '2026-09-12'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T15:17:21.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78175'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/RestAPI.php#L190
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L204
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L213
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L217
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.7/classes/Withdraw.php#L44
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3690454%40tutor&new=3690454%40tutor
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077d56-11e7-4e74-abe0-63e81db67be3?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.01073
epssPercentile: 0.63413
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T13:26:20.914058Z'
ingestedAt: '2026-09-14T15:23:07.480Z'
---

## Overview

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.