A significant vulnerability in the Tutor LMS WordPress plugin could enable low-privileged users to execute remote code and deploy web shells on vulnerable websites This article explores tutor_save_withdraw_account vulnerable handler. . Wordfence researchers, with the assistance of its Argus AI research agent, identified the flaw on August 23, 2026.
This issue affects Tutor LMS versions 4.0.7 and earlier, a commonly used e-learning plugin installed on over 100,000 WordPress sites. Many Tutor LMS websites allow students to register freely, which means an unauthenticated visitor may be able to create an account and then exploit the flaw. Tutor LMS Enables Webshells The issue exists in the plugin’s withdrawal-account management feature, specifically an authenticated AJAX action named tutor_save_withdraw_account.
The vulnerable handler checked whether a request contained a valid WordPress nonce, but it did not verify whether the user had instructor-level permissions. Researchers discovered that attacker-controlled withdrawal fields were processed using WordPress's esc_sql() function, which is meant for SQL query handling rather than storing serialized user metadata. The injected object chain could load the bundled PayPal Composer autoloader and access the GuzzleHttp\Cookie\FileCookieJar class.
They can use it to steal data, modify website content, gain persistent administrator access, deploy malware, or penetrate deeper into the hosting environment. Wordfence confirmed this fix. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
