CVE-2026-78175 (CVSS 8.8): PHP Object Injection in Tutor LMS lets any subscriber-level user achieve full RCE on 100,000+ WordPress sites via a serialization length-desync and GuzzleHttp POP chain. - CVE-2026-78175, CVSS 8.8 (High). Affects Tutor LMS versions 4.0.7 and below. The entry point is the tutor_save_withdraw_account AJAX handler in classes/Withdraw.php, which lacks a capability check and relies solely on a nonce that any logged-in user can obtain from the homepage. Since most Tutor LMS installs enable open student registration, an anonymous visitor can self-register and immediately exploit the flaw. - The root cause is esc_sql() misapplied to values destined for update_user_meta(). WordPress internally expands each % character to a 66-byte HMAC token, serializes the inflated string, then collapses the token back on DB write, leaving serialized length declarations 65 bytes larger than actual content. A second request triggers unserialize() on the corrupted blob, over-reading into attacker-controlled POST keys and materializing injected objects. - The POP chain works by injecting a reference to ecommerce\PaymentGateways\Paypal\vendor\autoload, which the plugin's spl_autoload_register loader in classes/RestAPI.php resolves and includes, bootstrapping the bundled Guzzle autoloader. #DFIR_Radar