A critical vulnerability in the Tutor LMS WordPress plugin could allow low-privileged users to execute code remotely and plant web shells on vulnerable websites.
Wordfence researchers, assisted by its Argus AI research agent, discovered the flaw on August 23, 2026. The issue affects Tutor LMS versions 4.0.7 and earlier, a widely used e-learning plugin installed on more than 100,000 WordPress sites.
Tracked as CVE-2026-78175, the vulnerability received a CVSS score of 8.8 out of 10. Themeum, the developer of Tutor LMS, fixed the issue in version 4.0.8, released on September 10, 2026.
The vulnerability is particularly serious because an attacker only needs subscriber-level access. Many Tutor LMS websites allow students to register freely, which means an unauthenticated visitor may be able to create an account and then exploit the flaw.
Tutor LMS Enables Webshells
The issue exists in the plugin’s withdrawal-account management feature, specifically an authenticated AJAX action named tutor_save_withdraw_account.
The vulnerable handler checked whether a request contained a valid WordPress nonce, but it did not verify whether the user had instructor-level permissions.
Since logged-in subscribers could obtain the required nonce from pages on the site, they could reach the sensitive function.
Researchers found that attacker-controlled withdrawal fields were processed with WordPress’s esc_sql() function before being saved as serialized user metadata.
This function is intended for SQL query handling, not for values that will later be serialized and stored.
When the input contained a percent symbol, WordPress temporarily expanded it into a long placeholder value. The plugin then serialized the expanded data and saved it in the database.
Before the database write was complete, WordPress converted the placeholder back into a normal percent symbol.
This created a mismatch between the serialized string’s declared size and its real size. When WordPress later unserialized the corrupted value, PHP could read into additional attacker-controlled data.
Attackers could exploit that behavior to inject malicious PHP objects into the serialized data. The injected object chain could load the bundled PayPal Composer autoloader and access the GuzzleHttp\Cookie\FileCookieJar class.
When the malicious object was destroyed, its destructor could write attacker-controlled content to a file path chosen by the attacker. This could enable the creation of a PHP web shell inside the WordPress uploads directory.
A web shell gives attackers remote command execution capabilities under the permissions of the web server.
They could use it to steal data, modify website content, create persistent administrator access, deploy malware, or move deeper into the hosting environment.
Tutor LMS version 4.0.8 fixes the vulnerability through several defenses. The update now restricts withdrawal-account changes to instructor accounts, removing the subscriber-level attack path, Wordfence said.
The patch also removes the unsafe use of esc_sql() during metadata handling. It applies safer sanitization methods to user input and validates withdrawal methods before saving data.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
