Executive brief
Tutor LMS is a popular WordPress plugin that delivers online courses and eLearning functionality. A vulnerability in its withdraw account feature allows attackers to inject malicious code and achieve remote code execution on the web server. An unauthenticated attacker can exploit this if user registration is enabled (common for student/teacher signup) and the monetization feature is active, potentially compromising the entire course platform and exposing student data.
Technical details
The vulnerability is a PHP Object Injection (CWE-502) in the `tutor_save_withdraw_account` AJAX handler via the `withdraw_method_field` parameter. The handler lacks proper capability and role checks (relying only on nonce validation), and passes attacker-supplied values through `esc_sql()` before serialization and storage via `update_user_meta()`. The `esc_sql()` function replaces `%` characters with HMAC placeholders; when the meta is later retrieved and unserialized, these placeholders collapse to single `%` characters, creating a length mismatch that causes `unserialize()` to over-read into attacker-controlled POST field names. An authenticated subscriber-level attacker (or unauthenticated if registration is enabled) can inject a malicious serialized object stream, which is then deserialized via the `GuzzleHttp\Cookie\FileCookieJar` POP chain accessible through the plugin's bundled PayPal Composer autoloader, achieving arbitrary file write and remote code execution.
Affected products
- Themeum Tutor LMS up to and including 4.0.7
Timeline
- 2026-09-12: disclosed