VulnSocial

CVE-2026-78175Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 7 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 7 signals
  • Disclosure: 3 classified signals
  • Peaked 4d ago at 2 mentions (2026-09-18); latest day: 1
  • 7 total mentions across 6 days

Deep dive

Activity timeline7 mentions / 6d
01122Mentions · 2026-09-17: 1Mentions · 2026-09-18: 2Mentions · 2026-09-19: 1Mentions · 2026-09-20: 1Mentions · 2026-09-28: 1Mentions · 2026-10-12: 1Patch / Workaround · 2026-09-18: 2Patch / Workaround · 2026-09-28: 1Patch / Workaround · 2026-10-12: 1Technical Details · 2026-09-17: 1Technical Details · 2026-09-18: 2Technical Details · 2026-09-19: 1Technical Details · 2026-09-20: 1Technical Details · 2026-09-28: 1Technical Details · 2026-10-12: 109-1709-1809-1909-2009-2810-12
Signal classification2 categories
Patch
457.1%
Disclosure
342.9%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-171
Disclosure1
2026-09-182
Patch2
2026-09-191
Disclosure1
2026-09-201
Disclosure1
2026-09-281
Patch1
2026-10-121
Patch1
Full discourse7 posts
  • elhacker.NET@elhackernet
    Disclosure

    Fallo en Tutor LMS expone más de 100.000 sitios de WordPress a ejecución remota de código Se ha detectado una vulnerabilidad de alta severidad (CVE-2026-78175) en el plugin Tutor LMS de WordPress, que afecta a más de 100,000 sitios https://blog.elhacker.net/2026/09/fallo-en-tutor-lms-expone-mas-de-100000.html

    Post summary

    The post discloses a high-severity remote code execution vulnerability (CVE-2026-78175) in the Tutor LMS WordPress plugin affecting over 100,000 sites, without mentioning patches, exploits, or active exploitation.

    01502384.6K
    142.5K followersView on X
  • Varun Dubey@vapvarun
    Patch

    On Tutor LMS 4.0.7 or older? Update this week. CVE-2026-78175 lets any logged-in student reach code execution, rated 8.8. Do it on staging first. A 30-minute test, 6 reported problems to check, and a rollback plan: https://reigntheme.com/course-plugin-update-checklist-tutor-lms/ #WordPress #LMS

    Post summary

    The text discloses CVE-2026-78175 in Tutor LMS (code execution, CVSS 8.8) but its primary focus is an explicit call to update, directing users to an update checklist, making Patch the dominant classification.

    0004177
    3.1K followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 Tutor LMS https://wpdeeply.com/tutor-lms-4-0-7-php-object-injection-rce-cve-2026-78175/ #loreleiweb Tutor LMS 4.0.7 and earlier is vulnerable to authenticated PHP Object Injection that can lead to remote code execution. The issue is tracked as CVE-2026-78175 and rated CVSS 8.8 (High). A subscriber-level account is sufficien… https://t.co/n131KLORYM

    Post summary

    The tweet discloses a PHP Object Injection vulnerability in Tutor LMS ≤4.0.7 (CVE‑2026‑78175) with CVSS 8.8 that can be exploited for remote code execution by an authenticated user, but it does not provide PoC, exploit code, patch information, or evidence of active exploitation.

    00010259
    85.8K followersView on X
  • DFIR Radar@DFIR_Radar
    Disclosure

    CVE-2026-78175 (CVSS 8.8): PHP Object Injection in Tutor LMS lets any subscriber-level user achieve full RCE on 100,000+ WordPress sites via a serialization length-desync and GuzzleHttp POP chain. - CVE-2026-78175, CVSS 8.8 (High). Affects Tutor LMS versions 4.0.7 and below. The entry point is the tutor_save_withdraw_account AJAX handler in classes/Withdraw.php, which lacks a capability check and relies solely on a nonce that any logged-in user can obtain from the homepage. Since most Tutor LMS installs enable open student registration, an anonymous visitor can self-register and immediately exploit the flaw. - The root cause is esc_sql() misapplied to values destined for update_user_meta(). WordPress internally expands each % character to a 66-byte HMAC token, serializes the inflated string, then collapses the token back on DB write, leaving serialized length declarations 65 bytes larger than actual content. A second request triggers unserialize() on the corrupted blob, over-reading into attacker-controlled POST keys and materializing injected objects. - The POP chain works by injecting a reference to ecommerce\PaymentGateways\Paypal\vendor\autoload, which the plugin's spl_autoload_register loader in classes/RestAPI.php resolves and includes, bootstrapping the bundled Guzzle autoloader. #DFIR_Radar

    Post summary

    CVE-2026-78175 is a PHP Object Injection in Tutor LMS (≤4.0.7) that lets any subscriber‑level user achieve full RCE via a serialization length‑desync and GuzzleHttp POP chain; the advisory details the technical mechanism but does not provide a patch or confirm active exploitation.

    10000171
    1.9K followersView on X
  • iototsecnews@iototsecnews
    Patch

    WordPress Tutor LMS プラグインの脆弱性 CVE-2026-78175 が FIX：Subscriber 権限での RCE の恐れ https://iototsecnews.jp/2026/09/19/over-100000-wordpress-sites-exposed-to-rce-through-tutor-lms-vulnerability/ WordPress プラグインの Tutor LMS において、深刻な脆弱性 CVE-2026-78175 が確認されました。誰でも登録可能な設定が多い背景があり、ログイン済みの購読者権限から安全でない処理を突いた不正アクセスを受ける恐れがあります。これにより Web サーバー上で任意のコードが実行され、システム全体が乗っ取られるという甚大な影響が懸念されます。対応策として、プラグインを最新版へ更新／不要なユーザー登録の制限／既存アカウントやログの点検／不審な作成ファイルの調査が求められます。 #CVE202678175 #Tutor LMS #Vulnerability #WordPress

    Post summary

    The article reports a critical RCE vulnerability in the Tutor LMS plugin and recommends updating to the latest version as the primary fix.

    00000101
    517 followersView on X
  • The CyberSec Guru@thecybersecguru
    Patch

    🔥 CRITICAL WordPress security alert! Tutor LMS CVE-2026-78175 can turn a low-privileged subscriber account into Remote Code Execution. ⚠️ CVSS 8.8 🎯 Tutor LMS ≤ 4.0.7 💥 PHP Object Injection → RCE 🌐 100,000+ sites potentially affected ✅ Fixed in 4.0.8 If you run Tutor LMS, update now. 🔗 https://thecybersecguru.com/news/cve-2026-78175-tutor-lms-rce/ #CyberSecurity #WordPress #CVE #RCE #InfoSec #WordPressSecurity #TutorLMS

    Post summary

    The tweet announces CVE-2026-78175 in Tutor LMS (≤4.0.7), a PHP Object Injection vulnerability enabling RCE with CVSS 8.8, and primarily directs users to update to the patched version 4.0.8.

    00000108
    1.6K followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Critical discovery: Tutor LMS plugin has a PHP object injection vulnerability (CVE-2026-78175) in versions up to 4.0.7, enabling remote code execution via student account registration. Now patched in v4.0.8. Update if you run WordPress + Tutor LMS to avoid exposure, audit roles, and limit open registrations. #WordPress #TutorLMS #Security #RCE #CVE2026 #CyberSecurity https://thedailytechfeed.com/critical-rce-bug-in-tutor-lms-puts-100000-wordpress-sites-at-risk/

    Post summary

    Discloses a critical PHP object injection RCE vulnerability in Tutor LMS (CVE-2026-78175) affecting versions up to 4.0.7, now resolved in v4.0.8 with an explicit call to update.

    0000060
    742 followersView on X

Explore more

Back to dashboard