An automated research agent at Wordfence spent part of August reading a WordPress course plugin and came out with a way for an ordinary student account to run code on the web server. The plugin is Tutor LMS, an e-learning tool active on more than 100,000 sites, and on most of those sites letting strangers sign up as students is the entire point.
Wordfence published the finding on September 17. It is tracked as CVE-2026-78175 and rated 8.8 out of 10. Themeum, the plugin's maker, shipped the fix in version 4.0.8 on September 10, so a patched release has been sitting in the update screen for a week.
A nonce is not a lock
The way in is an AJAX handler named tutor_save_withdraw_account, the code that saves an instructor's payout details. Wordfence found it registered on the logged-in hook with no capability check anywhere in its body. Its only gate is a nonce, the one-time token WordPress uses to prove a request came from one of its own pages, and Tutor LMS prints that token into every front-end page load. Any logged-in subscriber can collect one by visiting the homepage.
That matters because the plugin ships its own student registration action. Where a site allows open enrollment, an anonymous visitor can create a subscriber account, load a page, and hold everything the handler asks for. The sibling handler that processes an actual withdrawal does check that the caller is an instructor. This one does not. Wordfence notes the path also requires the plugin's monetization feature to be switched on, which narrows the exposed population below the full 100,000 installs.
One escape function in the wrong place
The bug underneath is stranger than a missing check. The handler runs attacker-supplied values through esc_sql(), a function meant for raw database query strings, before storing them with update_user_meta(). Internally esc_sql() swaps every percent sign for a 66-byte placeholder token, a WordPress safety measure that stops percent signs being read as format specifiers. The inflated string is then serialized with its inflated length recorded, and WordPress strips the token back out to a single percent sign as the row is written.
What lands in the database is a serialized string that declares 71 bytes and holds 6. When the value is read back and unserialized, PHP reads 65 bytes past the end of it and into the next array element, and those array keys come straight from POST field names that nobody sanitized. An attacker fills the over-read with padding and follows it with a serialized object of their choosing. Wordfence reached remote code execution from there through a Guzzle cookie jar class inside a PayPal library the plugin bundles, which writes attacker-controlled content to an attacker-named file. Sending the same request twice is enough to set it off, because the second request reads the corrupted value back.
Update to 4.0.8 before the free rule lands
Updating Tutor LMS to 4.0.8 closes it. Owners who cannot update immediately should check whether open registration and the monetization and withdrawal features are all enabled together, because that combination is what turns a throwaway student account into server access. Wordfence Premium, Care and Response customers received a firewall rule on August 25. Sites running the free plugin get the same rule on September 24, which leaves a window in which an unpatched free install has neither the fix nor the block.
Chloe Chamberland and the Wordfence Argus agent are credited with the discovery, reported to Themeum on August 23 and acknowledged the following day. The full write-up, including the serialization walk-through, is in Wordfence's original report. It is the second high severity WordPress finding from the same agent in a month: in August it chained six bugs into a takeover of the Avada theme. Whatever else automated code review proves to be good for, it is turning out to be good at reading plugin code more patiently than anyone was reading it before.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.