Tutor LMS Flaw Lets Subscriber Accounts Trigger Remote Code Execution

Key points

• Wordfence's Argus team reported a PHP Object Injection flaw in the Tutor LMS WordPress plugin.
• More than 100,000 WordPress sites are said to run the affected plugin.
• An attacker holding only Subscriber-level access could reportedly reach remote code execution.
• The vendor fix is Tutor LMS version 4.0.8; no CVE identifier was listed in the advisory.
• Any district WordPress site offering online courses should be treated as potentially exposed.

Wordfence's Argus research team has disclosed a PHP Object Injection vulnerability in Tutor LMS, a WordPress plugin used to build and sell online courses. According to the advisory, the flaw affects more than 100,000 WordPress installations and can be leveraged by an attacker who holds nothing more than a Subscriber account on the site. From that low-privilege starting point, the reported outcome is remote code execution, meaning an attacker could potentially run their own code on the underlying server rather than merely read or alter course content.

The detail that matters most for schools is the required access level. Subscriber is the default role handed out by WordPress when self-registration is enabled, and many districts leave registration open so students, parents, or community members can create accounts. If a site combines Tutor LMS with open registration, the practical barrier to exploitation drops sharply. Sites that restrict registration to known users, or that disable it entirely, still carry risk because any compromised or stale account could serve the same purpose.

Tutor LMS is a natural fit for K-12 and higher-ed sites that host course catalogs, quizzes, and paid or gated training. That makes this a plugin-level problem with a district-level blast radius: a single vulnerable WordPress instance could sit on shared hosting alongside other services, and code execution on the web tier is often a stepping stone rather than the final objective. The advisory does not describe the specific exploitation chain, so defenders should not assume a particular payload or indicator set.

The remediation path is straightforward. The advisory states that updating Tutor LMS to version 4.0.8 resolves the issue, and that update should be treated as urgent rather than folded into a routine monthly maintenance window. No CVE identifier was included in the information provided, so tracking this through a CVE feed alone may miss it; teams should verify status directly against the plugin's changelog and their own inventory of WordPress installs.

What to watch next: whether a CVE is assigned, whether proof-of-concept exploit code circulates publicly, and whether the vendor or researchers publish indicators of compromise. In the meantime, inventory every WordPress site in the district, confirm which ones run Tutor LMS, and check the installed version. Where patching cannot happen immediately, consider temporarily restricting or disabling self-registration and reviewing Subscriber accounts for anything unexpected.

What to do now

1. Update the Tutor LMS plugin to version 4.0.8 or later on every WordPress instance in the district, and verify the version number after the update rather than trusting the update prompt.
2. Inventory all WordPress sites and confirm which ones run Tutor LMS, including sites managed by individual schools, departments, or third-party vendors.
3. If patching must be delayed, temporarily disable open self-registration and audit existing Subscriber-level accounts for unknown, stale, or unexpected users.
4. Review web server and WordPress logs for suspicious POST requests to Tutor LMS endpoints, unexpected file writes, or new administrative users.
5. Apply the principle of least privilege: ensure no routine account holds more capability than its role requires, and remove dormant accounts.
6. Confirm whether a CVE identifier has since been assigned and subscribe to the vendor's and Wordfence's advisories for follow-up exploitation guidance.
7. Where feasible, isolate WordPress hosting from other district services so that code execution on the web tier cannot pivot into internal systems.

Original source

Wordfence