Wordfence says a newly disclosed vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites, could let authenticated attackers with subscriber-level access reach remote code execution on the server. The issue, tracked as CVE-2026-78175 and rated 8.8 high, affects Tutor LMS versions 4.0.7 and earlier and was patched in version 4.0.8.
What Wordfence Argus found in Tutor LMS
According to Wordfence, its AI research agent Wordfence Argus identified a PHP Object Injection flaw on August 23, 2026. The company says the bug sits in Tutor LMS’s withdraw account management feature and can be triggered through the withdraw_method_field parameter in the plugin’s tutor_save_withdraw_account AJAX handler.
The security firm says the weakness stems from an interaction between WordPress’s database abstraction layer and PHP’s serialization engine. In practical terms, attacker-controlled input can be stored in a way that corrupts serialized data, which later allows an injected object stream to be interpreted by PHP.
Why subscriber-level access matters
Wordfence describes the issue as authenticated, but the bar for access is low on many Tutor LMS sites. The plugin is built around student enrollment, and many installations enable open registration by default. That means a visitor may be able to sign up, obtain subscriber-level access, and then reach the vulnerable code path.
The company also notes that the related withdrawal feature is meant for instructors, but the affected handler lacked the capability or role check that would normally keep subscribers out. Wordfence says the handler relied on a nonce alone, and that nonce is exposed to logged-in users on frontend page loads.
From stored data to code execution
Wordfence’s write-up explains that the flaw is not a simple input-validation bug. Instead, it involves serialized data being written to user meta in a corrupted form, then later read back and unserialized by WordPress. That read can overrun into attacker-controlled bytes and produce an arbitrary serialized object stream.
Once that happens, the chain can continue into a bundled third-party library. Wordfence says the injected payload can trigger a GuzzleHttpCookieFileCookieJar POP chain, which ultimately writes attacker-controlled content to an attacker-specified filename. In the scenario described by Wordfence, that file can become a PHP web shell, leading to remote code execution.
Scope, severity, and affected versions
Wordfence’s intelligence entry lists the issue as affecting Tutor LMS versions up to and including 4.0.7, with 4.0.8 as the patched release. The company assigned the flaw CVE-2026-78175 and a CVSS score of 8.8, indicating a high-severity issue.
The relevant summary from Wordfence Intelligence describes the vulnerability as a PHP Object Injection path to remote code execution for authenticated users with subscriber-level access and above. Wordfence also says the unauthenticated pathway can exist when user registration is enabled, which is common on sites using Tutor LMS for students and teachers.
How Wordfence and Themeum responded
Wordfence says it sent full disclosure details to the Themeum team through its Vulnerability Management Portal on August 23, 2026, the same day it validated the report. Themeum acknowledged the issue on August 24 and released Tutor LMS 4.0.8 on September 10.
Wordfence praised Themeum’s response and said its own firewall customers received protection before the patch was published. Premium, Care, and Response users got a firewall rule on August 25, 2026. Users on Wordfence’s free tier were scheduled to receive the same rule 30 days later, on September 24, 2026.
What changed in the patch
Wordfence says the 4.0.8 fix addresses the problem at multiple points. The most important change is a proper instructor-only capability check on the vulnerable handler. The patch also removes the unsafe use of esc_sql() from the serialization path and adds tighter validation of field names and withdrawal method data.
In other words, the fix does not rely on a single control. It closes the access path, prevents the serialization corruption, and restricts the data that can be stored in the first place.
What site owners should do now
The advice from Wordfence is straightforward: update Tutor LMS immediately to version 4.0.8 or later. Because the plugin is often used on sites that welcome student registration, delaying the update could leave a low-friction attack path open to anyone who can create an account.
Administrators who use Wordfence should also note the timing of the firewall coverage. Even with that protection in place, the safest option is still to patch. A firewall rule can reduce risk, but it is not a substitute for removing the vulnerable code from production.
- Check whether Tutor LMS is installed and whether the site allows open registration.
- Confirm the plugin version is 4.0.8 or newer.
- Review whether withdrawal and monetization features are enabled.
- Monitor for unfamiliar subscriber accounts or unexpected file changes.
Why this bug stands out
The case is notable because it combines a relatively low-privilege entry point with a deep technical chain. Wordfence says the flaw spans several components, reaches into WordPress core behavior, and ends in a third-party library bundled with the plugin. That kind of chain is exactly why ordinary-seeming backend features can become high-impact security risks.
For WordPress site owners, the broader lesson is familiar: plugins that handle registration, payments, or account settings deserve the same urgency as public-facing marketing pages. When one of those components is compromised, the result can be more than data exposure; it can become full server control.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 18, 2026 at 10:32 pm
0 views
