PHP Object Injection in Tutor LMS WordPress Plugin

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and a

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Tutor LMS, a widely-deployed WordPress eLearning plugin, contains a critical PHP Object Injection vulnerability in its withdraw account AJAX handler. The flaw exists because the `tutor_save_withdraw_account` function accepts unsanitized user input via the `withdraw_method_field` parameter without proper capability checks, relying only on a nonce for protection. This allows unauthenticated attackers to inject malicious serialized PHP objects that trigger arbitrary code execution when deserialized. Any WordPress site running Tutor LMS versions up to 4.0.7 is at risk, potentially exposing student data, course content, and administrative functions to compromise.

Casky's 447 mapped security skills enable practitioners to detect this attack chain across MITRE ATT&CK's Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002) phases. Claude's extended reasoning analyzes suspicious AJAX requests to the `tutor_save_withdraw_account` endpoint, identifies serialized object patterns in POST parameters, and flags nonce-only reliance as inadequate access control. Practitioners would see findings highlighting CWE-502 indicators: unusual base64-encoded payloads, PHP class instantiation attempts, and calls to magic methods like `__wakeup()` or `__destruct()`. The skill set correlates these technical signals with attack intent, helping teams distinguish reconnaissance from exploitation attempts and prioritize Tutor LMS plugin updates immediately.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78175.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-78175

Casky has 447 skills that investigate the attack patterns behind CVE-2026-78175. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn