The Tutor LMS plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.0.7. The vulnerability exists in the tutor_save_withdraw_account AJAX handler, which lacks capability or role checks and relies solely on a nonce. Attacker-supplied input is passed through esc_sql(), which replaces % characters with a 66-byte HMAC placeholder before serialization and storage via update_user_meta(). Upon retrieval, the placeholder collapses back to a single %, causing length mismatches in serialized strings. Because array keys come from unescaped POST field names, unserialize() reads beyond intended data into attacker-controlled bytes, enabling injection of arbitrary serialized objects. Authenticated attackers with subscriber-level access can achieve remote code execution by triggering a POP chain in GuzzleHttp\Cookie\FileCookieJar via the plugin's autoloader. An unauthenticated attack vector exists if user registration and monetization are enabled.

Successful exploitation allows remote code execution on the server hosting the Tutor LMS plugin. This can lead to full compromise of the WordPress environment and potentially the underlying server. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unauthenticated attack path increases risk in environments where user registration and monetization are enabled.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling user registration and monetization features if enabled, to reduce exposure to the unauthenticated attack vector. Limit subscriber-level access and monitor for suspicious activity related to the withdraw_method_field AJAX handler.