CVE-2026-78175: Tutor LMS PHP Object Injection in withdraw method handler

CVE-2026-78175 · Severity: high · CVSS 8.8 · Published 2026-09-12

Tutor LMS is a popular WordPress plugin that delivers online courses and eLearning functionality. A vulnerability in its withdraw account feature allows attackers to inject malicious code and achieve remote code execution on the web server. An unauthenticated attacker can exploit this if user registration is enabled (common for student/teacher signup) and the monetization feature is active, potentially compromising the entire course platform and exposing student data.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-78175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-78175 being exploited in the wild.
How severe is CVE-2026-78175?
High severity, with a CVSS score of 8.8, published 12 September 2026.
Which products and versions are affected?
Themeum Tutor LMS up to and including 4.0.7.
Is there a fix for CVE-2026-78175?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78175 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-78175?
Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a PHP Object Injection (CWE-502) in the `tutor_save_withdraw_account` AJAX handler via the `withdraw_method_field` parameter. The handler lacks proper capability and role checks (relying only on nonce validation), and passes attacker-supplied values through `esc_sql()` before serialization and storage via `update_user_meta()`. The `esc_sql()` function replaces `%` characters with HMAC placeholders; when the meta is later retrieved and unserialized, these placeholders collapse to single `%` characters, creating a length mismatch that causes `unserialize()` to over-read into attacker-controlled POST field names. An authenticated subscriber-level attacker (or unauthenticated if registration is enabled) can inject a malicious serialized object stream, which is then deserialized via the `GuzzleHttp\Cookie\FileCookieJar` POP chain accessible through the plugin's bundled PayPal Composer autoloader, achieving arbitrary file write and remote code execution.

Affected products

  • Themeum Tutor LMS up to and including 4.0.7

Timeline

  • 2026-09-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.