CVE-2026-78175 is a PHP Object Injection vulnerability in the Tutor LMS WordPress plugin (versions up to 4.0.7). The issue arises from the `tutor_save_withdraw_account` AJAX handler, which does not enforce capability or role checks and relies solely on a nonce. It improperly processes the `withdraw_method_field` parameter by escaping SQL input with `esc_sql()`, which replaces '%' characters with a 66-byte HMAC token before serializing and storing user meta data. Upon retrieval, the placeholder collapses back to a single '%', causing length mismatches in serialized strings. Because array keys come from unescaped POST field names, `unserialize()` reads beyond intended boundaries into attacker-controlled data, enabling injection of arbitrary serialized objects. This leads to remote code execution via the `GuzzleHttp\Cookie\FileCookieJar` POP chain, triggered through the plugin's autoloader. The vulnerability affects authenticated users with subscriber-level access and can be exploited unauthenticated if user registration and monetization are enabled.

Successful exploitation allows remote code execution on the server hosting the Tutor LMS plugin. This can lead to full compromise of the WordPress environment and underlying system. The vulnerability affects confidentiality, integrity, and availability of the affected system. It can be exploited by low-privileged authenticated users and potentially unauthenticated users if user registration and monetization features are enabled.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable user registration and monetization features if enabled, restrict access to the affected AJAX handler, and monitor for suspicious activity. Avoid using the affected versions of Tutor LMS plugin in production environments.