Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-12T08:16:24.507Z",
  "pubdate": "2026-09-12T08:16:24.507Z",
  "executiveSummary": "The Tutor LMS WordPress plugin, in versions up to and including 4.0.7, contains a critical PHP Object Injection vulnerability within the 'tutor_save_withdraw_account' AJAX handler.\nThe vulnerability arises from insufficient authorization checks and improper handling of user-supplied data, allowing authenticated attackers (subscriber-level and above) to inject malicious serialized objects.\nIf user registration is enabled, this flaw potentially allows unauthenticated exploitation, provided the monetization feature is active.\nThe successful exploitation of this vulnerability facilitates Remote Code Execution (RCE) via a Property-Oriented Programming (POP) chain utilizing the 'GuzzleHttp\\Cookie\\FileCookieJar' class.\nThis vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site, as it permits arbitrary file creation and command execution.\nImmediate action is required to address this risk, as attackers can leverage the plugin's own bundled dependencies to bypass standard security controls.",
  "technicalDetails": "The root cause of the vulnerability lies in the 'tutor_save_withdraw_account' AJAX handler, which fails to perform robust capability or role checks, relying exclusively on a nonce for request validation.\nThe application processes the 'withdraw_method_field' parameter by passing attacker-controlled input through 'esc_sql()'. This function introduces a critical data manipulation issue where the '%' character is replaced by a 66-byte HMAC placeholder.\nWhen this data is stored in the database via 'update_user_meta()', the injected placeholder token is collapsed back into a single '%' character upon retrieval. This process results in a discrepancy between the stored serialized string length declaration and the actual byte count of the content, specifically an overestimation by 65 bytes.\nBecause array keys derived from POST data remain unescaped, an attacker can manipulate the serialization structure. During 'unserialize()', the discrepancy allows the parser to over-read into subsequent attacker-controlled bytes, facilitating the injection of arbitrary serialized objects into the application scope.\nExploitation is achieved by constructing a POP chain using 'GuzzleHttp\\Cookie\\FileCookieJar'. When the 'TUTOR\\RestAPI' component registers its autoloader, it exposes the bundled PayPal Composer autoloader, which provides the necessary gadgets to trigger the POP chain.\nThe attacker-controlled object allows the instantiation of 'FileCookieJar', enabling the attacker to write arbitrary content to an attacker-specified file path on the server filesystem. By targeting web-accessible directories, the attacker can achieve Remote Code Execution.\nThe attack flow follows these steps: 1) The attacker initiates an AJAX request to 'tutor_save_withdraw_account'. 2) The attacker submits a crafted 'withdraw_method_field' payload designed to trigger the length-mismatch issue after 'esc_sql()' processing and database round-tripping. 3) Upon retrieving the meta data, the 'unserialize()' call consumes the malicious object. 4) The POP chain executes, utilizing the 'GuzzleHttp' gadget to write a malicious payload to a target file, resulting in code execution."
}